This is our old Q&A Site. Please post any new questions and answers at

Dear Wireshark-Folks,

due to the fact that I am not too experienced with wireshark, I would appreciate for some advice whats going on with the following capture:

  • Capture was performed on client PC (
  • A custom application is running on this computer, but the behaivor is quite slow.
  • This application does database queries, starts transfering files, ... with different servers . You see it inside the capture.
  • Malformed packets are, because the capture was anonymized with Tracewrangler. So, data after Layer4 has been removed, but that should do the trick.

The question is if network/application problem and which application server or the client itself?

Thank you so much.

asked 23 Sep '15, 00:24

dark_scorp's gravatar image

accept rate: 0%

edited 23 Sep '15, 00:33


From capture it looks that slowness is from,on this server delayed ack is enabled(200ms) and after each empty ack App server is taking approx 800ms to send new should ask your app programmer about this pattern.

(23 Sep '15, 09:45) kishan pandey

The 800ms delay is from your client, probably building its SQL query.

As Kishan said, Delayed ACK is on, but as you are doing DB Queries, this is USUALLY a good thing. You could drop it to 100 if you are really worried. But turning it off may flood little packets everywhere.

Network is fast'ish with(6-7ms). Server OS/SQL is fast (pretty much instant). But the client is causing delays of 800 or 200 ms all the time. And they add up. Between Packets 187 and 250 of stream 6 you have already 6 seconds, of which around 75% is spent waiting on the app to do whatever it is doing.

(24 Sep '15, 02:28) DarrenWright

Thank you for your replies! So I will check the application running localy on the workstation.

(24 Sep '15, 02:31) dark_scorp
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 23 Sep '15, 00:24

question was seen: 3,387 times

last updated: 24 Sep '15, 02:31

p​o​w​e​r​e​d by O​S​Q​A