This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I'm using wireshark to calculate the page load up time for a website. I'm comparing the results from other online tools such as "http://www.webpagetest.org" and see the results don't tally.

My capture filters is:

dst host 1.1.1.1 or src host 1.1.1.1

Further, my capture filter is

!(tcp.flags.reset == 1) && !(tcp.flags.fin == 1)

I'm looking at page load up time through he following UI "statistics -> summary" and reading the " time between first and last packet" values.

Differences in coming in seconds not ms between online test and wireshark test done from my computer. I'm using wireless NIC card.

Is there a way to tweak the param's on wireshark to bring more close to real results.

asked 14 Aug '15, 00:38

lazerz's gravatar image

lazerz
4181014
accept rate: 0%

edited 14 Aug '15, 00:39


http://www.webpagetest.org loads a web page from servers in their datacenter (spread around the world), so packets are taking a totally different path compared to the test form your own PC. So, there has to be a difference in load time, unless you are sitting in one of the datacenters of webpagetest.org ;-))

Is there a way to tweak the param's on wireshark to bring more close to real results.

Please define real results after you've read what I have written above.

Regards
Kurt

permanent link

answered 15 Aug '15, 02:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thanks for analysis, but the fact is that from my pc/laptop the server I'm tried to reach is local as far as my geo-location is concerned. The difference is greater on my side and lower from results of "webpagetest.org". The fact the packets take different path is true of any "packet switched based network".

Other thing is I'm trying to figure out when I should close wireshark capturing.

I have workaround it like manually, as the wireshark is "ON" i keep a look on website page, as soon it loaded (which i check load-status icon at end of address bar) I close wireshark, then i see more accurate results.

But then I see that for complete page-load up perhaps the main index page is visible but at background there are other content e.g css,.theme files that are being downloaded from external sources (that are not visible on UI itself).

So, logically is it "ok" to close the wireshark as soon as the browser ended up loading the page. Thanks.

(15 Aug '15, 04:00) lazerz

but the fact is that from my pc/laptop the server I'm tried to reach is local as far as my geo-location is concerned.

That doesn't matter. Sometimes packets are taking long routes, even if the server is in a datacenter at the next corner of the street, because you and the datacenter are attached to totally different ISPs and there is no direct peering between those two. So, it really all depends on the number of hops between you and the server AND also the available bandwidth. If one (or both) of these is better for webpagetest.org, they will get better page load times than you. Furthermore: The definition of "page load time" is also important. I don't know how webpagetest.org defines that, so that could be a reason for the difference as well.

So, logically is it "ok" to close the wireshark as soon as the browser ended up loading the page. Thanks.

I don't know, because that depends on the page design. If some scripts are loading content in the background, even after the page "looks" done in the browser, then you would miss something if you close Wireshark too fast.

(15 Aug '15, 04:09) Kurt Knochner ♦

I'm okay with second part of answer, but with first I expect the ISP routing follows basic principle of "shortest path first". I'm sure the traceroute done against same server from usa and one done within same geolocation will wary. Within same geolocation ISP core router will maintain the list of "routes" which are advertised as being closest to the destibation. So the knowledge or hops between closest neighbours couldn't and shouldn't be as far away or same as if the same routing path is taken from I.e usa. Also for address that are geolinked as per dist by ARIN etc router wouldn't do upstream lookup for resolution of those addresses doesn't make sense. I'm not talking external hosting or mobile IP.Traffic at best be rounded by tier 2 or 3 Levels ISP.

(15 Aug '15, 05:07) asad

I expect the ISP routing follows basic principle of "shortest path first".

despite your expectation, the 'shortest' path is sometimes elected to go via different continents, as it's the cheapest path for the ISP ;-)

Anyway, without any further information about

  • the hop count
  • rtt
  • bandwidth
  • packet loss rate

of your link and the link used by webpagetest.org this discussion will not produce any new insights, besides what I have already posted :-)

(15 Aug '15, 08:11) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×86
×55
×4

question asked: 14 Aug '15, 00:38

question was seen: 2,617 times

last updated: 15 Aug '15, 08:12

p​o​w​e​r​e​d by O​S​Q​A