Hi all... I have a packet capture for traffic between a pair of hosts that covers 15 minutes, and includes 112 TCP connections between the two. Another tool (NetScout) reported that, within this 15 minutes, there was a high response time (160ms), and I want to isolate that request/response pair. (The average response time between the two was only 1ms, so this particular response time is an outlier that I need to diagnose.) It seemed that adding the column "Delta time (conversation)" would allow me to isolate long delays within TCP conversations, but, after adding it, the value in that column is blank, for every frame. By the way, I'm using 1.12.1, which I believe is the latest "stable" release. Any help in getting Delta time conversation to work - or, for another way to find the high response time - would be greatly appreciated. Thx, feenyman99 asked 14 Jul '15, 04:44  feenyman99 |
One Answer:
First, Go to Edit > Preferences > Protocols > TCP and turn on "Calculate conversation timestamps. Then, in the Packet Details pane, expand the Transmission Control Protocol portion of any TCP packet. Scroll down to the section labeled "[Timestamps]". Expand that section, then right-click on "[Time since previous frame in this TCP stream]" and select "Apply as column." Note that the "[Timestamps]" section won't be present unless you've turned on "Calculate conversation timestamps." answered 14 Jul '15, 05:08  Jim Aragon |
FYI, 1.12.6 is the latest stable (as I type this).