This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi What is the best way to view the difference between several captured graphs? Wireshark only display one graph at a time – how can I compare? Thanks

asked 30 Oct '10, 08:38

jonesKon's gravatar image

jonesKon
1111
accept rate: 0%


Way back when, I used to use tcptrace and jplot. It took a little work to get it going but it fit my needs at the time. I also played around with "http://www.packetbone.com/Applications/Excel.htm" a while back. It wasn't too bad, but I found that Wireshark gave me most of what I need.

When built in (graphing) capabilities are exceeded, I usually turn to

1) Cace's Pilot. AWESOME AWESOME tool!
2) Opnet's ACE or IT-Guru. Expensive, but quite nice if you know how to use it properly. The danger is that it spits out official answers and it can lull the user into thinking "I got the answer!"

Good luck.

Hansang

permanent link

answered 01 Nov '10, 15:34

hansangb's gravatar image

hansangb
7912619
accept rate: 12%

Which graphs do you want to compare?

You can (at least on a Windows host) open multiple graphs simultaneously - e.g., open the IO graph and then toggle back to Wireshark to open the TCP Time-Sequence graph. By toggling you can place them side-by-side.

If you want to compare IO or TCP Time-Sequence graphs of two different trace files, open two instances of Wireshark and graph in each instance.

If, however, you want to compare two traffic elements, such as all HTTP traffic to FTP traffic, you can add graph lines to a single IO or advanced IO graph.

If you are interested in the TCP Time-Sequence graph of two conversations in a single trace file, you'll need to separate them into separate trace files - conversation filter them each out into separate files and open in separate Wireshark instances.

permanent link

answered 30 Oct '10, 10:54

lchappell's gravatar image

lchappell ♦
1.2k2730
accept rate: 8%

edited 30 Oct '10, 10:55

hi You can have a look at this answer:

http://www.mail-archive.com/[email protected]/msg12342.html

Or use the following application which does this also:

http://www.softpedia.com/get/Network-Tools/Network-Testing/CapsGraph.shtml

permanent link

answered 31 Oct '10, 03:50

ron's gravatar image

ron
1111
accept rate: 0%

Wouldn’t two monitors and two instances of wireshark be the best way to go?

permanent link

answered 01 Nov '10, 13:12

net_tech's gravatar image

net_tech
116303337
accept rate: 13%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×19
×10
×1

question asked: 30 Oct '10, 08:38

question was seen: 4,885 times

last updated: 01 Nov '10, 15:34

p​o​w​e​r​e​d by O​S​Q​A