Hi, i need to determine my real bandwidth usage in windows, but i find discrepancies when comparing different methods. Cacti says im using 3Mbps I/O: Net Limiter says aim using 2Mbps I/O Resource monitor says im using 2Mbps I/O Task manager says im using 3% of 100Mbps = 3Mbps I/O (I think so) I attach an image with this methods in that order..
This differences increases and are more noticeable when bandwidth usage increases. Which method should i trust and why this differences? Is there any way i can measure bandwidth usage capturing packets with Wireshark? Thank you! asked 28 Jul '16, 02:40  dobledosis |
One Answer:
You have two options... Load the file under WireShark and select Statistics -> Summary and look at the bottom. OR... Use Capinfos and dump the results to a text file showing something similar to the following: Note: Packets DON'T LIE!!! ( GRIN ) FWIW answered 28 Jul '16, 08:10  wbenton edited 28 Jul '16, 09:38  grahamb ♦ |
Thank you. That option is in legacy version. After looking at Wireshark i found that Cacti and Task manager are more accurate. What could be the reason for this difference?
I would assume that each of the tools uses a different classification on which traffic on the interface should be taken into account for bandwidth occupation calculation (not all frames on the Ethernet interface make it beyond the first router, and people are usually interested in the bandwidth on the site uplink). Wireshark gives you the possibility to define the criteria yourself (at worst by filtering only some packets into a new file and using capinfos on it).
Another possibility could be that some tools may include the Ethernet preambles and checksums into the calculation, which to date Wireshark doesn't.
As for accuracy - to what reference value do you compare? If Cacti and Task manager just show the same value over the same traffic, it only means they use the same formula.
How are you comparing?
Did you capture using all 3 tools and compared the difference? Or did you use one tool (which one) to capture and all 3 tools to compare the differences?
Wireshark captures at the DLL layer and includes all packets from that layer upwards so it doesn't include the preamble data at layer 1.
As for which is more accurate, you would have to compare apples to apples to really say for sure.
Each program has their own calculation method so I guess it would be more correct to say, which calculation method do you prefer?
FWIW
In the exaple i gave there's only 1Mbps I/O of difference, but as bandwith usage increases, that difference increases even more, for example last night i had 14Mbps I/O with Cacti, task manager and Wireshark, and 10Mbps I/O with Net limiter and Resource monitor. So i preffer the method that includes as many packets as it can add to the final result.