This is our old Q&A Site. Please post any new questions and answers at

I'm desperately trying to determine which clients (IP) are causing a large amount of lag to my server. I have been able to manually scan packet data with IP filters to determine which ones have a large bad packets / total packet ratio, but this is a very labor intensive process. Is there a way to display all clients simultaneously and their "bad" packets / their total packets ratio? Thanks in advance!


asked 17 Sep '11, 02:32

mikebriggs2k's gravatar image

accept rate: 0%

I'm not sure what "you" mean by bad packets, but I assume you are able to create a display filter that will match only the bad packets. In that case, there are two ways of doing this.

In Wireshark:

  • Use the display filter for "bad" packets
  • Go to "Statistics -> Endpoints"
  • Click on the IP TAB
  • Use "copy" to copy the data in CSV format to clipboard
  • Import the data in a tool of choice
  • Now enable the "Limit to display filter" checkmark
  • Again use copy to export the data
  • Use your tool of choice to match the IP addresses in both outputs

In tshark:

The steps are basically the same, but now use the following to commands to create the output:

  • tshark -r <file> -qz conv,ip
  • tshark -r <file> -qz conv,ip<bad-packet-filter>

This assumes the destination address is always the server-ip as tshark will create conversation overviews, not endpoint overviews.

permanent link

answered 17 Sep '11, 03:32

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 17 Sep '11, 02:32

question was seen: 5,303 times

last updated: 17 Sep '11, 03:32

p​o​w​e​r​e​d by O​S​Q​A