This is a static archive of our old Q&A Site. Please post any new questions and answers at

Wireshark - Calculate Delta Time



Very new to wireshark. I am trying to find average timer between 2 messages in about 50-60 separate wireshark traces collected. The messages are (1) "Get URL" message and (2)the first packet with size >1400 Bytes. Is it possible to write a query or any other method to find this in single trace or for all traces at once?


asked 04 Feb '16, 07:09

tanz_eel's gravatar image

accept rate: 0%

One Answer:


Wireshark, as well as tshark which may be more useful for you as you talk about handling multiple files, uses a "display filter" to limit the display of packets (frames) to those matching some conditions. The conditions compare real fields of the packets (such as ip.dst, fields of their metadata (such as frame.time), and pseudo-fields computed by some protocol dissectors (such as to constant values or to other fields, but always only fields defined for a single packet are taken into account when evaluating the conditions for that packet. Only few dissectors keep track about other packets belonging to the same conversation and compute pseudo-fields allowing to see (and use in display filter conditions) e.g. the delay of a response after a request.

Lucky for you, this is the case for http: for the first packet of an http response, the dissector calculates a pseudo-field http.time. So a display filter http.time alone would show you only the response packets; a display filter http.time and (http.content_length > 1400) would show you only the first packets of responses whose total (payload!) size is over 1400 bytes, and a display filter http.time and (frame.len > 1400) would show you only first packets of responses where the size of such first frame, including all the headers starting from the Ethernet one, is over 1400 bytes.

Now for your purpose, you would probably use a script, calling a tshark with all your 60 files as parameters and calculating the average from the displayed values. The command for a single file looks as follows:

tshark -r your_capture_file_name -Y "http.time and (frame.len > 1400)" -T fields -e http.time

This outputs only the http response times found in the file, one per line.

answered 04 Feb '16, 22:37

sindy's gravatar image

accept rate: 24%