Wireshark · Wireshark-users: Re: [Wireshark-users] Question on measuring on both sides of a masquerading server.

[Sake Blok | SYN-bit <sake.blok@xxxxxxxxxx>]

> On 23 Apr 2019 (Tue), at 19:42, L A Walsh <wireshark@xxxxxxxxx> wrote:
> 
> How might I see or measure the rtt time of the remote->MasqServ?.  I
> don't suppose it would be possible to have the the return-trip times,
> both to the MasqServ and to the client added together to see a total?

Please note that RTT calculations are done from the view of the capture point. So if you capture near system A, the roundtrip times for traffic being sent from A to B will be showing the 'real' roundtrip times, as the data packets are seen at the capture point just slightly after they have left system A. Then the ACK comes in after the packet has traversed the network over to system B and B sent the ACK back. But when system B sends data, it has already travelled the network all the way to system A, then A sends the ACK and it is seen by the capturing machine before it travels all the way back to system B.

So, unless you are able to capture on the remote side, you will only be able to deduct the TCP RTT times by looking at the traffic that is sent from our side to the remote side.

Hope this helps,
Cheers,

Sake