This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello I captured file download logs in wireshark. Now I want calculate this metrics :

  1. TCP throughput, capacity, round-trip time,...
  2. download time, response time, time to complete task, ...

I don't find this metrics values in wireshark. How I can calculate this metrics by my TCP logs in wireshark ? please help me completely , because I am beginner in wireshark.

Thank You

asked 08 Apr '16, 13:37

abdorreza's gravatar image

abdorreza
6112
accept rate: 0%

edited 09 Apr '16, 03:58

grahamb's gravatar image

grahamb ♦
19.8k330206

HELP me please !

(09 Apr '16, 00:15) abdorreza

Hi, I'll try to give you some guidance. I'll assume that you are using Wireshark 2.

TCP Throughput

I'm not completely sure what you mean by this but if you want to know the data rate on a particular TCP connection you can do this by selecting a particular TCP stream. As an example I'll use TCP Stream 0 to an SMB file server (on TCP Port 445):

  • Go to Menu > Statistics > IO Graph
  • Click on the + button in the bottom left of the graph window
  • Name the new plot TCP Stream 0 Tx
  • In the Display Filter field enter tcp.stream==0 && tcp.dstport==445
  • In the Y Axis field select Bits/s
  • Check the box next to the name to display the result (uncheck all plots)
  • Click on the + button in the bottom left of the graph window
  • Name the new plot TCP Stream 0 Tx
  • In the Display Filter field enter tcp.stream==0 && tcp.srcport==445
  • In the Y Axis field select Bits/s
  • Check the box next to the name to display the result

Capacity

Not sure what you mean. You could measure apparent capacity by plotting Bits/s in the Tx and Rx directions and looking for the maximum value.

Round Trip Time

I think most people measure this by looking at the delta between a SYN and a SYN/ACK. You can do this by sorting the trace by tcp.stream, filtering for packets with the SYN flag set and adding the column Time delta from previously displayed frame. Export the Summary Line into CSV and then fiddling around with the CSV in Excel.

A much quicker way is to use the TRANSUM plugin - see http://www.tribelab.com/transum:

  • Start Wireshark with TRANSUM
  • Open the trace file
  • Set a display filter tcp.flags.syn==1 && transum
  • Expand the TRANSUM RTE Data tree in the packet detail frame
  • Right click on APDU Response Time and Apply as Column
  • You should now see the SYN to SYN/ACK delays and hence the nominal RTT

I'll deal with the remaining points in little later - have to get off the train I'm on.

permanent link

answered 11 Apr '16, 07:39

PaulOfford's gravatar image

PaulOfford
131273237
accept rate: 11%

Download Time, Response Time, Time to Complete Task

Many of the dissectors include response time values. Look out for values in headers such as Time from request. To study I would add the value as a column and then export to CSV, although you can probably also do a lot with the built-in graphing.

TRANSUM is also a big help here and the TRANSUM User Guide gives a lot of detail about extracting response time information from Wireshark traces.

(11 Apr '16, 07:45) PaulOfford
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×55
×35
×23

question asked: 08 Apr '16, 13:37

question was seen: 3,616 times

last updated: 11 Apr '16, 07:59

p​o​w​e​r​e​d by O​S​Q​A