Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11920] New: IO Graph: NFS/RPC not congruent with underlaying TCP

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11920
Summary	IO Graph: NFS/RPC not congruent with underlaying TCP
Product	Wireshark
Version	Git
Hardware	x86
OS	Windows Server 2008 R2
Status	UNCONFIRMED
Severity	Normal
Priority	Low
Component	Qt UI
Assignee	bugzilla-admin@wireshark.org
Reporter	carstengrohmann@gmx.de

Created attachment 14178 [details]
Example of non-congruent curves

Build Information:
Version 2.0.1rc0-215-g3a28602 (v2.0.0-215-g3a28602 from master-2.0)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with WinPcap (4_1_3), with libz 1.2.8, with
GLib 2.42.0, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.2, with GnuTLS
3.2.15, with Gcrypt 1.6.2, with MIT Kerberos, with GeoIP, with QtMultimedia,
with AirPcap.

Running on 64-bit Windows Server 2008R2 Service Pack 1, build 7601, with
locale
C, without WinPcap, with GnuTLS 3.2.15, with Gcrypt 1.6.2, without AirPcap.
Six-Core AMD Opteron(tm) Processor 2431, with 65533MB of physical memory.


Built using Microsoft Visual C++ 12.0 build 31101

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
Error description
=================

The current implementation of the IO Graph shows a wrong the NFS/RPC throughput
in comparison with the throughput of the underlying TCP stream. 

I expect the curves of RPC and NFS are congruent with the curve of the
underlying TCP stream. But this isn't. The attached screen-shot shows the
differences.

Based on two packages out of TCP stream 1 we can calculate the throughput :

PKG 1:
405852 09:40:25.840177 172.16.1.11 172.16.2.100 NFS 598 V3 WRITE Call (Reply In
405994), FH: 0x2678a6b8 Offset: 3276800 Len: 65536 UNSTABLE
Transmission Control Protocol, Src Port: 949 (949), Dst Port: 2049 (2049), Seq:
3350625, Ack: 6493, Len: 532

PKG 2:
621670 09:40:57.514164 172.16.1.11 172.16.2.100 NFS 598 V3 WRITE Call (Reply In
621885), FH: 0x2678a6b8 Offset: 374833152 Len: 65536 UNSTABLE
Transmission Control Protocol, Src Port: 949 (949), Dst Port: 2049 (2049), Seq:
375791497, Ack: 936373, Len: 532

Calculation:
TCP seqnums: (375791497-3350625)/32./2**20 = 11.099
FH offset: (374833152-3276800)/32./2**20 = 11.07

There are "no" differences between NFS and TCP. Thereby the NFS/RPC curve
should be congruent with the TCP steam.


Expectations
============
IO Graph shows congruent curves for all three graphs.


Package details
===============

No.     Time               Source                Destination           Protocol
Length Info
 405852 09:40:25.840177    172.16.1.11           172.16.2.100          NFS     
598    V3 WRITE Call (Reply In 405994), FH: 0x2678a6b8 Offset: 3276800 Len:
65536 UNSTABLE

Frame 405852: 598 bytes on wire (4784 bits), 598 bytes captured (4784 bits)
Ethernet II, Src: HewlettP_6d:45:80 (68:b5:99:6d:45:80), Dst: CiscoInc_9f:f0:02
(00:00:0c:9f:f0:02)
Internet Protocol Version 4, Src: 172.16.1.11, Dst: 172.16.2.100
Transmission Control Protocol, Src Port: 949 (949), Dst Port: 2049 (2049), Seq:
3350625, Ack: 6493, Len: 532
    Source Port: 949
    Destination Port: 2049
    [Stream index: 1]
    [TCP Segment Len: 532]
    Sequence number: 3350625    (relative sequence number)
    [Next sequence number: 3351157    (relative sequence number)]
    Acknowledgment number: 6493    (relative ack number)
    Header Length: 32 bytes
    Flags: 0x018 (PSH, ACK)
    Window size value: 1540
    [Calculated window size: 1540]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x5e7b [validation disabled]
    Urgent pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
    TCP segment data (532 bytes)
[17 Reassembled TCP Segments (65692 bytes): #405836(2896), #405837(4344),
#405838(4344), #405839(4344), #405840(4344), #405841(4344), #405842(2896),
#405843(4344), #405844(4344), #405845(4344), #405846(4344), #405847(4344),
#405848(2896), #]
    [Frame: 405836, payload: 0-2895 (2896 bytes)]
    [Frame: 405837, payload: 2896-7239 (4344 bytes)]
    [Frame: 405838, payload: 7240-11583 (4344 bytes)]
    [Frame: 405839, payload: 11584-15927 (4344 bytes)]
    [Frame: 405840, payload: 15928-20271 (4344 bytes)]
    [Frame: 405841, payload: 20272-24615 (4344 bytes)]
    [Frame: 405842, payload: 24616-27511 (2896 bytes)]
    [Frame: 405843, payload: 27512-31855 (4344 bytes)]
    [Frame: 405844, payload: 31856-36199 (4344 bytes)]
    [Frame: 405845, payload: 36200-40543 (4344 bytes)]
    [Frame: 405846, payload: 40544-44887 (4344 bytes)]
    [Frame: 405847, payload: 44888-49231 (4344 bytes)]
    [Frame: 405848, payload: 49232-52127 (2896 bytes)]
    [Frame: 405849, payload: 52128-56471 (4344 bytes)]
    [Frame: 405850, payload: 56472-60815 (4344 bytes)]
    [Frame: 405851, payload: 60816-65159 (4344 bytes)]
    [Frame: 405852, payload: 65160-65691 (532 bytes)]
    [Segment count: 17]
    [Reassembled TCP length: 65692]
    [Reassembled TCP Data: 800100982c93805c0000000000000002000186a300000003...]
Remote Procedure Call, Type:Call XID:0x2c93805c
    Fragment header: Last fragment, 65688 bytes
    XID: 0x2c93805c (747864156)
    Message Type: Call (0)
    RPC Version: 2
    Program: NFS (100003)
    Program Version: 3
    Procedure: WRITE (7)
    [The reply to this request is in frame 405994]
    Credentials
    Verifier
Network File System, WRITE Call FH: 0x2678a6b8 Offset: 3276800 Len: 65536
UNSTABLE
    [Program Version: 3]
    [V3 Procedure: WRITE (7)]
    file
    offset: 3276800
    count: 65536
    Stable: UNSTABLE (0)
    Data: <DATA>

No.     Time               Source                Destination           Protocol
Length Info
 621670 09:40:57.514164    172.16.1.11           172.16.2.100          NFS     
598    V3 WRITE Call (Reply In 621885), FH: 0x2678a6b8 Offset: 374833152 Len:
65536 UNSTABLE

Frame 621670: 598 bytes on wire (4784 bits), 598 bytes captured (4784 bits)
Ethernet II, Src: HewlettP_6d:45:80 (68:b5:99:6d:45:80), Dst: CiscoInc_9f:f0:02
(00:00:0c:9f:f0:02)
Internet Protocol Version 4, Src: 172.16.1.11, Dst: 172.16.2.100
Transmission Control Protocol, Src Port: 949 (949), Dst Port: 2049 (2049), Seq:
375791497, Ack: 936373, Len: 532
    Source Port: 949
    Destination Port: 2049
    [Stream index: 1]
    [TCP Segment Len: 532]
    Sequence number: 375791497    (relative sequence number)
    [Next sequence number: 375792029    (relative sequence number)]
    Acknowledgment number: 936373    (relative ack number)
    Header Length: 32 bytes
    Flags: 0x018 (PSH, ACK)
    Window size value: 1540
    [Calculated window size: 1540]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x5e7b [validation disabled]
    Urgent pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
    TCP segment data (532 bytes)
[17 Reassembled TCP Segments (65692 bytes): #621654(2896), #621655(4344),
#621656(4344), #621657(4344), #621658(4344), #621659(4344), #621660(2896),
#621661(4344), #621662(4344), #621663(4344), #621664(4344), #621665(4344),
#621666(2896), #]
    [Frame: 621654, payload: 0-2895 (2896 bytes)]
    [Frame: 621655, payload: 2896-7239 (4344 bytes)]
    [Frame: 621656, payload: 7240-11583 (4344 bytes)]
    [Frame: 621657, payload: 11584-15927 (4344 bytes)]
    [Frame: 621658, payload: 15928-20271 (4344 bytes)]
    [Frame: 621659, payload: 20272-24615 (4344 bytes)]
    [Frame: 621660, payload: 24616-27511 (2896 bytes)]
    [Frame: 621661, payload: 27512-31855 (4344 bytes)]
    [Frame: 621662, payload: 31856-36199 (4344 bytes)]
    [Frame: 621663, payload: 36200-40543 (4344 bytes)]
    [Frame: 621664, payload: 40544-44887 (4344 bytes)]
    [Frame: 621665, payload: 44888-49231 (4344 bytes)]
    [Frame: 621666, payload: 49232-52127 (2896 bytes)]
    [Frame: 621667, payload: 52128-56471 (4344 bytes)]
    [Frame: 621668, payload: 56472-60815 (4344 bytes)]
    [Frame: 621669, payload: 60816-65159 (4344 bytes)]
    [Frame: 621670, payload: 65160-65691 (532 bytes)]
    [Segment count: 17]
    [Reassembled TCP length: 65692]
    [Reassembled TCP Data: 8001009852a9805c0000000000000002000186a300000003...]
Remote Procedure Call, Type:Call XID:0x52a9805c
    Fragment header: Last fragment, 65688 bytes
    XID: 0x52a9805c (1386840156)
    Message Type: Call (0)
    RPC Version: 2
    Program: NFS (100003)
    Program Version: 3
    Procedure: WRITE (7)
    [The reply to this request is in frame 621885]
    Credentials
    Verifier
Network File System, WRITE Call FH: 0x2678a6b8 Offset: 374833152 Len: 65536
UNSTABLE
    [Program Version: 3]
    [V3 Procedure: WRITE (7)]
    file
    offset: 374833152
    count: 65536
    Stable: UNSTABLE (0)
    Data: <DATA>

---

      You are receiving this mail because:

• You are watching all bug changes.