Wireshark · Wireshark-users: Re: [Wireshark-users] Question about seeing Latency in TCP conversations

[Martin Visser <martinvisser99@xxxxxxxxx>]

Johnny,

The easiest way is to examine the calculated field "tcp.analysis.ack_rtt". This appears in the details window if you have TCP Sequence Analysis on.

You have to be a little careful when using this though, as Wireshark sometimes miscalculates this in the prescence of Duplicate ACKs. The best way to use it (taking out effects of the server processing delay), is during the initial handshake. So what I do is filter for "tcp.flags == 0x12" (which is the SYN/ACK) and plot tcp.analysis.ack_rtt or add it as a column.

Regards, Martin

MartinVisser99@xxxxxxxxx

On 5 January 2012 08:20, Sheahan, John <John.Sheahan@xxxxxxxxxxxxx> wrote:

I have been given a sniffer trace by our application guys and they want me to look through it to see if any of the TCP conversations have higher than normal latencies.

The file is kind of big and too much data for me to filter and look at each conversation.

 

Is there an easy way to do this in Wireshark?

 

Thanks

 

Johnny

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe