Hi Everybody, i use Wireshark since some years to help me to troubleshoot performance issue. As Wireshark can see the between packets, it should provide the total time spend (by processing). I never find in Wireshark where i can have this kind of information. I can't imagine Wireshark doesn't provide this information. Could you help me? Best regards asked 28 Mar '12, 08:13  any-one |
2 Answers:
Wireshark is for analyzing network communications, not server performance. Yes, Wireshark sees the time between packets, but Wireshark doesn't know how much of that time was because the server was processing a request, and how much was because it simply didn't have anything to send. Note also that some of the time between packets will be network latency; how much depends partly on where you are doing your capturing. However, if you know enough about the communication, you may be able to get an idea of the processing time involved in a particular transaction. See this link for a Sharkfest presentation in which Laura Chappell shows how to determine the various types of latency involved in a web server communication. Page 9 shows how to determine how much time the server spent processing a GET request before returning data. answered 28 Mar '12, 12:32  Jim Aragon |
I, i think i find a solution. In wireshark i can display a new column with Dealta-time (which is the time between last packet). From a capture done on the server - i filter only packet sent by server - i export to CSV file - I open this CSV in Excel an calculate easily the sum of the column "Delta Time". If i'm not wrong, this represent the total processing time of the server. Best regards answered 29 Mar '12, 00:24 any-one |
Hi Jim
thanks for your reply. I agree, it depends of where the capture is doing. Of course, it's possible to see server processing time only if the capture is done on the server.
Capturing at both end (in client and in server) during a communication, it should be interresting to calculate easily processing time at each end and so determine easily if the performance issue is caused on the server, on the client or in the network (latency, too many round-trip..).
Best regards