This is our old Q&A Site. Please post any new questions and answers at

How can I use wireshark to identify slow network proformance for only internet traffic? Also where is the internet traffic being delayed at. All LAN and WAN traffic for the most part is fast, however when it comes to internet traffic it becomes very very slow. I have installed wireshark on a server and capturing packets filtered with HTTP port 80 traffic. What would be the tell tell sign in the capture packets for internet traffice slowness.

asked 05 Aug '11, 13:20

helpomatic's gravatar image

accept rate: 0%

In your case you might want to look for requests that take a long time to answer. If you're talking about web traffic you might want to filter for GET and POST requests, or simply any request at all. You can do that by filtering on http.request.method.

To see how long it takes the webserver to start sending the content you could filter on the HTTP response code, for example http.response.code.

Combined, you could do http.request.method or http.response.code, and then take a look at the time it took from the request to the response. Keep in mind that this will only tell the time the server needed to start sending content after the request was issued, and that the network latency is included as well. To find out why loading a big web page takes a long time you'd also need to find out where the last packet is, and then determine the delta time between request and complete arrival of all content.

permanent link

answered 05 Aug '11, 17:32

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Jasper, First I would like to thank you for taking your time to write a response. I must say I am an new to using wireshark, however I was able to use those filters you have requested. They work fine, but for me I am at a lost for words at the time difference. I have saved the capture file, so I can understand when I can interpret what it is telling me.

(06 Aug '11, 05:02) helpomatic

Never was able to use the http.request.method or the http.response.code to solve the slow network for internet traffic only. Worked with Verizon and was able to determine that the default route was wrong. After correcting the default route internet is now working fine. A simple traceroute identified the problem. Thank you for your help.

permanent link

answered 08 Aug '11, 12:31

helpomatic's gravatar image

accept rate: 0%

I'm also just opening Wireshark and it's intimidating. I've been working with ISP and we've got a bunch of unidentified traffic uploading and downloading via the Internet. I would like to pinpoint which users (addresses) are creating the traffic, but don't know how to set it up.

permanent link

answered 05 Sep '13, 13:36

caruncles's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Aug '11, 13:20

question was seen: 16,455 times

last updated: 05 Sep '13, 13:36

p​o​w​e​r​e​d by O​S​Q​A