This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Delta Time (Conversation) field is blank

0

Hi all...

I have a packet capture for traffic between a pair of hosts that covers 15 minutes, and includes 112 TCP connections between the two.

Another tool (NetScout) reported that, within this 15 minutes, there was a high response time (160ms), and I want to isolate that request/response pair. (The average response time between the two was only 1ms, so this particular response time is an outlier that I need to diagnose.)

It seemed that adding the column "Delta time (conversation)" would allow me to isolate long delays within TCP conversations, but, after adding it, the value in that column is blank, for every frame.

By the way, I'm using 1.12.1, which I believe is the latest "stable" release.

Any help in getting Delta time conversation to work - or, for another way to find the high response time - would be greatly appreciated.

Thx, feenyman99

asked 14 Jul '15, 04:44

feenyman99's gravatar image

feenyman99
96222226
accept rate: 25%

FYI, 1.12.6 is the latest stable (as I type this).

(14 Jul '15, 05:24) grahamb ♦

One Answer:

0

First, Go to Edit > Preferences > Protocols > TCP and turn on "Calculate conversation timestamps.

Then, in the Packet Details pane, expand the Transmission Control Protocol portion of any TCP packet. Scroll down to the section labeled "[Timestamps]". Expand that section, then right-click on "[Time since previous frame in this TCP stream]" and select "Apply as column."

Note that the "[Timestamps]" section won't be present unless you've turned on "Calculate conversation timestamps."

answered 14 Jul '15, 05:08

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%