Wireshark-bugs: [Wireshark-bugs] [Bug 8647] New: SUM(tcp.time_delta)tcp.time_delta incorrect
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sun, 12 May 2013 17:48:57 +0000
Bug ID 8647
Summary SUM(tcp.time_delta)tcp.time_delta incorrect
Classification Unclassified
Product Wireshark
Version 1.8.6
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Minor
Priority Low
Component TShark
Assignee bugzilla-admin@wireshark.org
Reporter skendric@fhcrc.org 

Build Information:
1.8.6 (SVN Rev 48142) and 1.10.0 RC1
--
I have a trace capturing an SMB file copy between Client and Server.  I'm using
Wireshark to calculate how much time the Client and the Server spent turning
around frames.

Using the GUI, I see an FBAR with an approximate height of 3s when I calculate
how long the Server spent turning around frames:
Filter:  tcp.srcport==445 Calc:SUM(*) tcp.time_delta Style:FBar Tick
interval:1min

And an FBAR with an approximate height of 42s when I calculate how long the
Client spent turning around frames:
Filter:  tcp.dstport==445 Calc:SUM(*) tcp.time_delta Style:FBar Tick
interval:1min

Using tshark, I see a rather different result ... ~44s for /both/ cases.
tshark -nlr server.pcap -o tcp.calculate_timestamp:TRUE -R "(tcp.srcport==445)"
-qz io,stat,600,"SUM(tcp.time_delta)tcp.time_delta"

================================================
| IO Statistics                                |
|                                              |
| Interval size: 44.1 secs (dur)               |
| Col 1: Frames and bytes                      |
|     2: SUM(tcp.time_delta)tcp.time_delta     |
|----------------------------------------------|
|              |1                  |2          |
| Interval     | Frames |   Bytes  |    SUM    |
|----------------------------------------------|
|  0.0 <> 44.1 |  50069 | 50551304 | 44.145992 |
================================================

tshark -nlr server.pcap -o tcp.calculate_timestamp:TRUE -R "(tcp.dstport==445)"
-qz io,stat,600,"SUM(tcp.time_delta)tcp.time_delta"
================================================
| IO Statistics                                |
|                                              |
| Interval size: 44.1 secs (dur)               |
| Col 1: Frames and bytes                      |
|     2: SUM(tcp.time_delta)tcp.time_delta     |
|----------------------------------------------|
|              |1                  |2          |
| Interval     | Frames |   Bytes  |    SUM    |
|----------------------------------------------|
|  0.0 <> 44.1 |  50069 | 50551304 | 44.145992 |
================================================

I'm willing to believe that 42s ~= 44s in the case of the Client ... but I
believe that the Server-side calculation (srcport==445) is an error.

If you would like more information, do let me know.

--sk

You are receiving this mail because:
  • You are watching all bug changes.