This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Diffrent download speed for sftp at wireshark and command line

0

Hi All, I have tested the bandwidth with simply tranfering a big file with sftp from one Linux server to another. But the transfer rates are demonsrated diferently at wireshark and command line.

Command Line: xxxxx.rpm 100% 127MB 11.5MB/s 00:11

Wireshark: I couldn't copy the image but the data at Protocol Hierarchy Statistics for SSH Protocol is 18.332 Mbit/s

Do you have any idea why this difference happenned?

BR Ercan

This question is marked "community wiki".

asked 26 Oct '15, 01:51

Ercansah's gravatar image

Ercansah
6112
accept rate: 0%


2 Answers:

0

Wireshark takes the paket length for it's statistics, while your tool might use the application payload bytes to calculate the throughput (dpends on that tools). That will certainly result in different throughput values.

Regards
Kurt

answered 26 Oct '15, 05:41

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hi Kurt, Thanks for your answer but it doesn't seem logical to me. The difference beyween application payload and the whole packet is the headers. Do you really think that headers can cause almost %50 b/w speed difference?

BR Ercan

(26 Oct '15, 22:54) Ercansah

Well, hard to tell without a capture file. In theory it would be possible, if you have a lot of small frames + plus what @mrEEde said. However we are talking about 11.5 Mbyte/s, so this is all rather unlikely. As I said, hard to tell without a capture file. Is it possible to upload it somewhere (dropbox, etc.) and post the link here?

BTW: Your tool reports 11.5 Mbyte/s, while you say that Wireshark reports 18.332 Mbits/s. So it's Mbyte/s versus Mbit/s. Is that a typo?

(27 Oct '15, 01:15) Kurt Knochner ♦

0

The Protocol Hierarchy Statistics for SSH takes packets in both directions into account whereas the SFTP only measures the throughput based on the payload in one direction.

answered 26 Oct '15, 23:40

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%