This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, i need to determine my real bandwidth usage in windows, but i find discrepancies when comparing different methods.

Cacti says im using 3Mbps I/O:

Net Limiter says aim using 2Mbps I/O

Resource monitor says im using 2Mbps I/O

Task manager says im using 3% of 100Mbps = 3Mbps I/O (I think so)

I attach an image with this methods in that order..

alt text

This differences increases and are more noticeable when bandwidth usage increases. Which method should i trust and why this differences?

Is there any way i can measure bandwidth usage capturing packets with Wireshark?

Thank you!

asked 28 Jul '16, 02:40

dobledosis's gravatar image

dobledosis
6112
accept rate: 0%


You have two options...

Load the file under WireShark and select Statistics -> Summary and look at the bottom.

OR...

Use Capinfos and dump the results to a text file showing something similar to the following:

File name:           10.0.25.131.pcapng
File type:           Wireshark/... - pcapng
File encapsulation:  Ethernet
File timestamp precision:  microseconds (6)
Packet size limit:   file hdr: (not set)
Number of packets:   147 k
File size:           121 MB
Data size:           116 MB
Capture duration:    2502.877350 seconds
First packet time:   2016-07-20 13:29:29.987184
Last packet time:    2016-07-20 14:11:12.864534
Data byte rate:      46 kBps
Data bit rate:       371 kbps
Average packet size: 785.35 bytes
Average packet rate: 59 packets/s
...

Note: Packets DON'T LIE!!! ( GRIN )

FWIW

permanent link

answered 28 Jul '16, 08:10

wbenton's gravatar image

wbenton
29227
accept rate: 0%

edited 28 Jul '16, 09:38

grahamb's gravatar image

grahamb ♦
19.8k330206

Thank you. That option is in legacy version. After looking at Wireshark i found that Cacti and Task manager are more accurate. What could be the reason for this difference?

(28 Jul '16, 17:03) dobledosis

I would assume that each of the tools uses a different classification on which traffic on the interface should be taken into account for bandwidth occupation calculation (not all frames on the Ethernet interface make it beyond the first router, and people are usually interested in the bandwidth on the site uplink). Wireshark gives you the possibility to define the criteria yourself (at worst by filtering only some packets into a new file and using capinfos on it).

Another possibility could be that some tools may include the Ethernet preambles and checksums into the calculation, which to date Wireshark doesn't.

As for accuracy - to what reference value do you compare? If Cacti and Task manager just show the same value over the same traffic, it only means they use the same formula.

(29 Jul '16, 00:32) sindy

After looking at Wireshark i found that Cacti and Task manager are more accurate<<<

How are you comparing?

Did you capture using all 3 tools and compared the difference? Or did you use one tool (which one) to capture and all 3 tools to compare the differences?

Wireshark captures at the DLL layer and includes all packets from that layer upwards so it doesn't include the preamble data at layer 1.

As for which is more accurate, you would have to compare apples to apples to really say for sure.

Each program has their own calculation method so I guess it would be more correct to say, which calculation method do you prefer?

FWIW

(29 Jul '16, 01:28) wbenton

In the exaple i gave there's only 1Mbps I/O of difference, but as bandwith usage increases, that difference increases even more, for example last night i had 14Mbps I/O with Cacti, task manager and Wireshark, and 10Mbps I/O with Net limiter and Resource monitor. So i preffer the method that includes as many packets as it can add to the final result.

(29 Jul '16, 04:49) dobledosis
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×57

question asked: 28 Jul '16, 02:40

question was seen: 15,731 times

last updated: 29 Jul '16, 04:49

p​o​w​e​r​e​d by O​S​Q​A