Hello, I'm using wireshark to calculate the page load up time for a website. I'm comparing the results from other online tools such as "http://www.webpagetest.org" and see the results don't tally. My capture filters is: Further, my capture filter is I'm looking at page load up time through he following UI "statistics -> summary" and reading the " time between first and last packet" values. Differences in coming in seconds not ms between online test and wireshark test done from my computer. I'm using wireless NIC card. Is there a way to tweak the param's on wireshark to bring more close to real results. asked 14 Aug '15, 00:38  lazerz edited 14 Aug '15, 00:39 |
One Answer:
http://www.webpagetest.org loads a web page from servers in their datacenter (spread around the world), so packets are taking a totally different path compared to the test form your own PC. So, there has to be a difference in load time, unless you are sitting in one of the datacenters of webpagetest.org ;-))
Please define real results after you've read what I have written above. Regards answered 15 Aug '15, 02:38  Kurt Knochner ♦ |
Thanks for analysis, but the fact is that from my pc/laptop the server I'm tried to reach is local as far as my geo-location is concerned. The difference is greater on my side and lower from results of "webpagetest.org". The fact the packets take different path is true of any "packet switched based network".
Other thing is I'm trying to figure out when I should close wireshark capturing.
I have workaround it like manually, as the wireshark is "ON" i keep a look on website page, as soon it loaded (which i check load-status icon at end of address bar) I close wireshark, then i see more accurate results.
But then I see that for complete page-load up perhaps the main index page is visible but at background there are other content e.g css,.theme files that are being downloaded from external sources (that are not visible on UI itself).
So, logically is it "ok" to close the wireshark as soon as the browser ended up loading the page. Thanks.
That doesn't matter. Sometimes packets are taking long routes, even if the server is in a datacenter at the next corner of the street, because you and the datacenter are attached to totally different ISPs and there is no direct peering between those two. So, it really all depends on the number of hops between you and the server AND also the available bandwidth. If one (or both) of these is better for webpagetest.org, they will get better page load times than you. Furthermore: The definition of "page load time" is also important. I don't know how webpagetest.org defines that, so that could be a reason for the difference as well.
I don't know, because that depends on the page design. If some scripts are loading content in the background, even after the page "looks" done in the browser, then you would miss something if you close Wireshark too fast.
I'm okay with second part of answer, but with first I expect the ISP routing follows basic principle of "shortest path first". I'm sure the traceroute done against same server from usa and one done within same geolocation will wary. Within same geolocation ISP core router will maintain the list of "routes" which are advertised as being closest to the destibation. So the knowledge or hops between closest neighbours couldn't and shouldn't be as far away or same as if the same routing path is taken from I.e usa. Also for address that are geolinked as per dist by ARIN etc router wouldn't do upstream lookup for resolution of those addresses doesn't make sense. I'm not talking external hosting or mobile IP.Traffic at best be rounded by tier 2 or 3 Levels ISP.
despite your expectation, the 'shortest' path is sometimes elected to go via different continents, as it's the cheapest path for the ISP ;-)
Anyway, without any further information about
of your link and the link used by webpagetest.org this discussion will not produce any new insights, besides what I have already posted :-)