Wireshark · Wireshark-users: Re: [Wireshark-users] high delta time for pvst

[Martin Visser <martinvisser99@xxxxxxxxx>]

How are you displaying the "delta time"? If you are changing the standard time display format, there are two options, one for the difference to the preceeding *displayed* packet and the other for the preceeding *captured* packet. (You clearly have a display filter enabled as your packet numbers are not consecutive)As I am very doubtful a Cisco router will send PVST+ BPDUs in intervals as short as say 5ms (packet 495) then it must be captured packets, as the delta displayed would be the difference from the previous packet (494) that isn't being displayed. So the packet 6573 you highlighted is probably just showing a relatively quiet time on your network - lots of activity between packet 6475 and 6572 and then nothing for 467ms. I am guessing that your PVST+ BPDU interval is probably around 1 second, to show this, change the time display format to the previous displayed format.

I think you find you have a similar problem when you are say just displaying ARPs, particular as ARP requests will occur for all intents at random intervals (based on when the application initiates a connection to previously unknown (or at least forgotten) IP address.

Regards, Martin

MartinVisser99@xxxxxxxxx

On Thu, Dec 31, 2009 at 2:07 PM, mark marek <markmarek1@xxxxxxxxx> wrote:

Why would this time be so high the port utilization is almost nothing.

6573    0.466959    Cisco_68:1f:1f    PVST+    STP    RST. Root = 8192/0/00:15:c7:6b:03:e6  Cost = 3  Port = 0x8682


I attached a screenshot but if it's tripped here is a picture. http://tinypic.com/r/25uhesz/6

Also some arps are high too
2345    0.437217    Cisco_6b:00:00    Broadcast    ARP    Who has 192.168.30.39?  Tell 192.168.1.2
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe