Wireshark · Ethereal-users: [Ethereal-users] Re: Question about Tools->Summary in Ethereal

["Tony Paredes" <tparedes@xxxxxxxxxxxxx>]

One thing to keep in mind when calculating through put is that the
interpacket gap and preamble are sometimes included in the calculation.  For
instance if you consider a fast ethernet pipe that is operating at capacity
with traffic made up of only 64 byte packets(approx 142,000 packets/second),
the actual data throughput is really only 76 megabits rather than the
expected 100 megabits.  The reason being that bandwidth is lost to the
interpacket gap, in this case 960 nanoseconds,(that comprises about 6 to 8
bytes) and the ethernet preamble which defaults to 12 bytes (I'm pretty
sure).

To make a short story long, it is important to make sure that you are
comparing apples to apples.

Sincerely,

Tony Paredes 			Cell Phone: 1 613 328 2365
Regional Sales Manager 		Canada Tel: 1 613 384 9694
Canada and Northern USA 		Toll Free: 1 800 723 2664
RADCOM Equipment Inc.
Home Page: www.radcom-inc.com
		www.protocols.com





-----Original Message-----
From: ethereal-users-admin@xxxxxxxxxxxx
[mailto:ethereal-users-admin@xxxxxxxxxxxx]On Behalf Of
ethereal-users-request@xxxxxxxxxxxx
Sent: June 5, 2001 1:01 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: Ethereal-users digest, Vol 1 #264 - 9 msgs


Send Ethereal-users mailing list submissions to
	ethereal-users@xxxxxxxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
	http://www.ethereal.com/mailman/listinfo/ethereal-users
or, via email, send a message with subject or body 'help' to
	ethereal-users-request@xxxxxxxxxxxx

You can reach the person managing the list at
	ethereal-users-admin@xxxxxxxxxxxx

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Ethereal-users digest..."


Today's Topics:

   1. Re: Cannot see outgoing packets (Bolan Meek)
   2. Re: Cannot see outgoing packets (Guy Harris)
   3. Question about Tools->Summary in Ethereal (Tao Lin)
   4. Re: Question about Tools->Summary in Ethereal (Guy Harris)
   5. RE: Question about Tools->Summary in Ethereal (Tao Lin)
   6. Re: newbie question (Guy Harris)
   7. RE: Question about Tools->Summary in Ethereal (Visser, Martin (SNO))
   8. Re: Cannot see outgoing packets (Ronnie Sellar)
   9. RE: promiscuous mode cannot work (Osawa Tatsuzo)

--__--__--

Message: 1
Date: Mon, 04 Jun 2001 10:39:21 +0000
From: Bolan Meek <bmeek@xxxxxxxxxxxx>
To: Ronnie Sellar <ronnie@xxxxxxxxxx>
Cc: Ethereal Users <ethereal-users@xxxxxxxxxxxx>
Subject: Re: [Ethereal-users] Cannot see outgoing packets

Ronnie Sellar wrote:

> Hi there
>
> I'm running Ethereal on Solaris and cannot see any outgoing packets from
> my own machine.  Software versions are:
> ...
> libpcap:        0.6
> ...
>
> Anyone got any ideas please ?

I have the same problem atop AIX 4.3.2.  Guy said to
recompile libpcap, which I had from a precompiled package
downloaded from the site Bull has for free software for
AIX.  I haven't gotten to it yet, so I
can't verify that this is the answer, but you might
get to it before me.




--__--__--

Message: 2
From: Guy Harris <guy@xxxxxxxxxx>
Subject: Re: [Ethereal-users] Cannot see outgoing packets
To: Ronnie Sellar <ronnie@xxxxxxxxxx>
Date: Mon, 4 Jun 2001 11:43:58 -0700 (PDT)
Cc: Ethereal Users <ethereal-users@xxxxxxxxxxxx>

> I'm running Ethereal on Solaris and cannot see any outgoing packets from
> my own machine.  Software versions are:
>
> Solaris:        2.7
> Ethereal:       0.8.18

Make absolutely positively sure you have enabled promiscuous mode; in
0.8.18, it's not the default, and, at least with some network devices in
at least some situations, not enabling promiscuous mode causes the SunOS
5.x packet capture mechanism not to see packets sent from the machine.

In the next release, promiscuous mode will be the default again,
although note that on 0.8.18 the promiscuous-vs-non-promiscuous mode was
made a saved preference, so that if you've ever done a "Save" from the
"Preferences" dialog box, Ethereal will default to non-promiscuous mode
even in the next release (unless we make it no longer a saved
preference), so you'd need to do a promiscuous-mode capture and then,
after the capture is done, select "Preferences" from the "Edit" menu and
then click "Save" to update the preferences (or edit your
"~/.ethereal/preferences" file, if you have one, and change the
"capture.prom_mode" line to say "TRUE" rather than "FALSE"; if you don't
have one, create one, with the line

	capture.prom_mode: TRUE

in it).

Doing the above should also make 0.8.18 default to promiscuous mode.


--__--__--

Message: 3
Date: Mon, 04 Jun 2001 21:43:51 -0400
From: Tao Lin <taolin@xxxxxx>
To: ethereal-users@xxxxxxxxxxxx
Cc: taolin@xxxxxx
Subject: [Ethereal-users] Question about Tools->Summary in Ethereal

This is a multi-part message in MIME format.

--Boundary_(ID_DD23FBMo/IHqVEEyopsfLA)
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: quoted-printable

I am using Ethereal 0.8.18 version to capture traffic in a LAN.=20

The traffic is TCP/IP traffic and the ethernet frame size is set to 590 =
bytes. The transmission rate is 600,000bps. So the interval time for 590 =
bytes should be 0.00786667 second.=20

In Ethereal capture results, most of those interval times I got are less =
than 0.00786667 second, but the Tools->Summary shows that the average =
transmission speed is lower than 600,000 bps. Can anyone tell me how =
Ethereal calculates the transmission speed? Thanks!

BTW: Please reply to my email box.=20

Have a good day!


--Boundary_(ID_DD23FBMo/IHqVEEyopsfLA)
Content-type: text/html; charset=iso-8859-1
Content-transfer-encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 5.50.4209.1800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>I am using Ethereal 0.8.18 version to =
capture=20
traffic in a LAN. </FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>The traffic is TCP/IP traffic and the =
ethernet=20
frame&nbsp;size is set to 590 bytes. The transmission rate is =
600,000bps.=20
So&nbsp;the interval time for 590 bytes&nbsp;should be 0.00786667 =
second.=20
</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>In Ethereal capture results, most =
of&nbsp;those=20
interval times&nbsp;I got are less than 0.00786667 second, but the=20
Tools-&gt;Summary shows that the average&nbsp;transmission speed is =
lower than=20
600,000 bps. Can anyone tell me how&nbsp;Ethereal calculates the =
transmission=20
speed? Thanks!</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>BTW: Please reply to my email box. =
</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Have a good day!</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV></BODY></HTML>

--Boundary_(ID_DD23FBMo/IHqVEEyopsfLA)--


--__--__--

Message: 4
From: Guy Harris <guy@xxxxxxxxxx>
Subject: Re: [Ethereal-users] Question about Tools->Summary in Ethereal
To: Tao Lin <taolin@xxxxxx>
Date: Mon, 4 Jun 2001 18:46:06 -0700 (PDT)
Cc: ethereal-users@xxxxxxxxxxxx

> Can anyone tell me how Ethereal calculates the transmission speed?

If, by "average transmission speed" you mean the "Avg. bytes/sec" value
in the summary dialog box, it's the sum of the sizes of all of the
packets, in bytes, divided by the time, in seconds, between the time
stamp of the first packet and the time stamp of the last packet.


--__--__--

Message: 5
Date: Mon, 04 Jun 2001 21:53:31 -0400
From: Tao Lin <talin@xxxxxx>
Subject: RE: [Ethereal-users] Question about Tools->Summary in Ethereal
To: Guy Harris <guy@xxxxxxxxxx>, Tao Lin <taolin@xxxxxx>
Cc: ethereal-users <ethereal-users@xxxxxxxxxxxx>

>===== Original Message From Guy Harris <guy@xxxxxxxxxx> =====
>> Can anyone tell me how Ethereal calculates the transmission speed?
>
>If, by "average transmission speed" you mean the "Avg. bytes/sec" value
>in the summary dialog box, it's the sum of the sizes of all of the
>packets, in bytes, divided by the time, in seconds, between the time
>stamp of the first packet and the time stamp of the last packet.

Thanks, but as I said in my email, the interval time is less than I
expected,
(which implies that the average speed should be higher than I expected), but
the average speed in the summary is also less than I expected. I think this
is
not reasonable. I still can't figure out the reason for it.

Thanks anyway!



--__--__--

Message: 6
From: Guy Harris <guy@xxxxxxxxxx>
Subject: Re: [Ethereal-users] newbie question
To: "Bernard, Kurt A." <KABERNARD@xxxxxxxxxxxx>
Date: Mon, 4 Jun 2001 19:20:38 -0700 (PDT)
Cc: "'ethereal-users@xxxxxxxxxxxx'" <ethereal-users@xxxxxxxxxxxx>

> I read the recent traffic concerning the treatment of encapsulated IP by
> ethereal.  I haven't seen anything in the documentation so I was wondering
> if someone could tell me just exactly what ethereal would do with an
> encapsulated traffic between a cisco and another router.
>
> While capturing or when viewing a capture file, does ethereal display only
> the stats on the encapsulated traffic between the two routers?  Or does it
> show stats for the traffic and nodes that are encapulated?

If the release of Ethereal you're using understands the particular form
of encapsulation being used, it'll display statistics for the traffic
that's encapsulated when viewing a capture file - however, it won't
necessarily do so when capturing (the code that updates the packet count
window doesn't spend as much time dissecting traffic as the code that
displays traffic, as a detailed dissection consumes CPU time that may be
required just to handle saving the incoming traffic).


--__--__--

Message: 7
From: "Visser, Martin (SNO)" <Martin.Visser@xxxxxxxxxx>
To: 'Tao Lin' <talin@xxxxxx>
Cc: ethereal-users <ethereal-users@xxxxxxxxxxxx>
Subject: RE: [Ethereal-users] Question about Tools->Summary in Ethereal
Date: Tue, 5 Jun 2001 10:22:14 +0800

To sanity check the calculations construct a display filter for a single one
second interval and use the Protocol Hierarchy stats in conjunction with
Summary and some manual calcs. Send your results back to the list and we can
then check the numbers out. My guess is that your actual transmission rate
is not as constant as you might hope.

Martin Visser
Network Consultant - Compaq Global Services

Compaq Computer Australia
410 Concord Road
Rhodes, Sydney NSW 2138
Australia

Phone: +61-2-9022-5630
Mobile: +61-411-254-513
Fax:+61-2-9022-7001
Email:martin.visser@xxxxxxxxxx



-----Original Message-----
From: Tao Lin [mailto:talin@xxxxxx]
Sent: Tuesday, 5 June 2001 11:54 AM
To: Guy Harris; Tao Lin
Cc: ethereal-users
Subject: RE: [Ethereal-users] Question about Tools->Summary in Ethereal


>===== Original Message From Guy Harris <guy@xxxxxxxxxx> =====
>> Can anyone tell me how Ethereal calculates the transmission speed?
>
>If, by "average transmission speed" you mean the "Avg. bytes/sec" value
>in the summary dialog box, it's the sum of the sizes of all of the
>packets, in bytes, divided by the time, in seconds, between the time
>stamp of the first packet and the time stamp of the last packet.

Thanks, but as I said in my email, the interval time is less than I
expected,
(which implies that the average speed should be higher than I expected), but

the average speed in the summary is also less than I expected. I think this
is
not reasonable. I still can't figure out the reason for it.

Thanks anyway!


_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users


--__--__--

Message: 8
Date: Tue, 05 Jun 2001 08:12:28 +0100
From: Ronnie Sellar <ronnie@xxxxxxxxxx>
Organization: Spider Software Ltd
To: Guy Harris <guy@xxxxxxxxxx>
Cc: Ethereal Users <ethereal-users@xxxxxxxxxxxx>
Subject: Re: [Ethereal-users] Cannot see outgoing packets

Guy Harris wrote:

> Make absolutely positively sure you have enabled promiscuous mode; in
> 0.8.18, it's not the default, and, at least with some network devices in
> at least some situations, not enabling promiscuous mode causes the SunOS
> 5.x packet capture mechanism not to see packets sent from the machine.

I do have promiscuous mode selected from the capture dialogue box and I
can see packets exchanged between other machines.

> then click "Save" to update the preferences (or edit your
> "~/.ethereal/preferences" file, if you have one, and change the
> "capture.prom_mode" line to say "TRUE" rather than "FALSE"; if you don't
> have one, create one, with the line
>
>         capture.prom_mode: TRUE

I saved my preferences and then went in and edited my preferences file
to match the above line.  This appears to have cured the problem.  It
looks like selecting promiscuous mode from the capture dialogue box does
not have the same effect as having it in your preferences file.

Thanks to Guy and Bolan for their help.

Yours Aye,

Ronnie
--
Ronnie Sellar				Spider Software Limited
Tel:  +44 131 475 7015			8 John's Place
Fax:  +44 131 475 7001			Edinburgh EH6 7EL
mailto:ronnie.sellar@xxxxxxxxxx		http://www.spider.com/


--__--__--

Message: 9
From: "Osawa Tatsuzo" <tatsuzo_osawa@xxxxxxxxxxx>
To: ethereal-users@xxxxxxxxxxxx
Subject: RE: [Ethereal-users] promiscuous mode cannot work
Date: Tue, 05 Jun 2001 16:52:25 +0900

I tried followings:

1. default preference file and check promiscuous mode
2. default preference file and uncheck promiscuous mode
3. customized preference file and check promiscuous mode
4. customized preference file and uncheck promiscuous mode
(customized preferese file means "capture.prom_mode: TRUE")

Promiscuous mode works only at the time of a pattern 3.
As unexpected, it does not work at the time of a pattern 1.

I will select pattern 3 from now.
Please fix up pattern 1.

>From: "Osawa Tatsuzo" <tatsuzo_osawa@xxxxxxxxxxx>
>To: McNuttJ@xxxxxxxxxxxx, ethereal-users@xxxxxxxxxxxx
>Subject: RE: [Ethereal-users] promiscuous mode cannot work
>Date: Mon, 04 Jun 2001 23:54:20 +0900
>
>Of course, that knows. By way of precaution, I tried both
>promiscuous mode
>chekbox on and off, it did not move.
>

_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.




--__--__--

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users


End of Ethereal-users Digest