This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi

Very new to wireshark. I am trying to find average timer between 2 messages in about 50-60 separate wireshark traces collected. The messages are (1) "Get URL" message and (2)the first packet with size >1400 Bytes. Is it possible to write a query or any other method to find this in single trace or for all traces at once?

Thanks

asked 04 Feb '16, 07:09

tanz_eel's gravatar image

tanz_eel
6113
accept rate: 0%


Wireshark, as well as tshark which may be more useful for you as you talk about handling multiple files, uses a "display filter" to limit the display of packets (frames) to those matching some conditions. The conditions compare real fields of the packets (such as ip.dst, fields of their metadata (such as frame.time), and pseudo-fields computed by some protocol dissectors (such as tcp.stream) to constant values or to other fields, but always only fields defined for a single packet are taken into account when evaluating the conditions for that packet. Only few dissectors keep track about other packets belonging to the same conversation and compute pseudo-fields allowing to see (and use in display filter conditions) e.g. the delay of a response after a request.

Lucky for you, this is the case for http: for the first packet of an http response, the dissector calculates a pseudo-field http.time. So a display filter http.time alone would show you only the response packets; a display filter http.time and (http.content_length > 1400) would show you only the first packets of responses whose total (payload!) size is over 1400 bytes, and a display filter http.time and (frame.len > 1400) would show you only first packets of responses where the size of such first frame, including all the headers starting from the Ethernet one, is over 1400 bytes.

Now for your purpose, you would probably use a script, calling a tshark with all your 60 files as parameters and calculating the average from the displayed values. The command for a single file looks as follows:

tshark -r your_capture_file_name -Y "http.time and (frame.len > 1400)" -T fields -e http.time

This outputs only the http response times found in the file, one per line.

permanent link

answered 04 Feb '16, 22:37

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×75
×12
×10

question asked: 04 Feb '16, 07:09

question was seen: 4,005 times

last updated: 04 Feb '16, 22:37

p​o​w​e​r​e​d by O​S​Q​A