Calculate Round Trip Time (RTT) manually

Question

How can we calculate Round Trip Time (RTT) from a passive traffic manually using the formula? I can obtain RTT values using tcptrace but it takes ONLy discrete values as it is shown in the graph below. For example, using tcptrace, we can get RTT values as in the following (the first column is time in seconds and the second column is RTT in milli seconds (ms)).

8.983596 4.000000
8.984129 3.000000
8.984829 4.00000

alt text

It seems TCP takes only the real values for RTT. Is there any way to export the values returned from tcp.analysis.ack_rtt to a file and apply the formula for an RTT? I tried with statistics -> RTT StreamGraph -> RTT Graph where I can plot the RTT graph but i can't export the values (X and Y coordinates as in the previous format from tcptrace) to a file. When we plot RTT in Wireshark, it shows the values as continuous but it doesn't seem possible to export the values to a file. Or is there anyway to extract these values using tcpdump or any other tool?

Answer 1

You could probably use tshark to do something like that, printing relative time of each frame with the ACK_RTT as columns, e.g.

[C:\]tshark -r "Sample.pcapng" -Tfields -e frame.time_relative -e tcp.analysis.ack_rtt
0.000000000
0.017430000     0.017430000
0.017456000     0.000026000
0.025576000
0.038697000     0.013121000
0.043810000
0.043818000     0.000008000
0.051572000
0.051960000
0.051966000     0.000006000
0.052220000
0.258296000     0.206076000
0.673018000
0.682172000     0.009154000
0.882325000     0.200153000
3.053319000
3.065140000     0.011821000
3.065235000
3.065239000     0.000004000

redirecting that output to a file should be simple enough.