Comparing several wireshak graphs

Way back when, I used to use tcptrace and jplot. It took a little work to get it going but it fit my needs at the time. I also played around with "http://www.packetbone.com/Applications/Excel.htm" a while back. It wasn't too bad, but I found that Wireshark gave me most of what I need.

When built in (graphing) capabilities are exceeded, I usually turn to

1) Cace's Pilot. AWESOME AWESOME tool!
2) Opnet's ACE or IT-Guru. Expensive, but quite nice if you know how to use it properly. The danger is that it spits out official answers and it can lull the user into thinking "I got the answer!"

Good luck.

Hansang

Which graphs do you want to compare?

You can (at least on a Windows host) open multiple graphs simultaneously - e.g., open the IO graph and then toggle back to Wireshark to open the TCP Time-Sequence graph. By toggling you can place them side-by-side.

If you want to compare IO or TCP Time-Sequence graphs of two different trace files, open two instances of Wireshark and graph in each instance.

If, however, you want to compare two traffic elements, such as all HTTP traffic to FTP traffic, you can add graph lines to a single IO or advanced IO graph.

If you are interested in the TCP Time-Sequence graph of two conversations in a single trace file, you'll need to separate them into separate trace files - conversation filter them each out into separate files and open in separate Wireshark instances.

hi You can have a look at this answer:

http://www.mail-archive.com/[email protected]/msg12342.html

Or use the following application which does this also:

http://www.softpedia.com/get/Network-Tools/Network-Testing/CapsGraph.shtml

Wouldn’t two monitors and two instances of wireshark be the best way to go?