Re: high delta time for pvst

[mark marek <markmarek1 () gmail com>]

I have it set for "seconds since previous captured packet" and and I
filtered the PVST+packets.  I was trying to the same thing I saw while
viewing a  wireshark university training session.


On Thu, Dec 31, 2009 at 4:40 PM, Martin Visser <martinvisser99 () gmail com>wrote:

> How are you displaying the "delta time"? If you are changing the standard
> time display format, there are two options, one for the difference to the
> preceeding *displayed* packet and the other for the preceeding *captured*
> packet. (You clearly have a display filter enabled as your packet numbers
> are not consecutive)As I am very doubtful a Cisco router will send PVST+
> BPDUs in intervals as short as say 5ms (packet 495) then it must be captured
> packets, as the delta displayed would be the difference from the previous
> packet (494) that isn't being displayed. So the packet 6573 you highlighted
> is probably just showing a relatively quiet time on your network - lots of
> activity between packet 6475 and 6572 and then nothing for 467ms. I am
> guessing that your PVST+ BPDU interval is probably around 1 second, to show
> this, change the time display format to the previous displayed format.
>
> I think you find you have a similar problem when you are say just
> displaying ARPs, particular as ARP requests will occur for all intents at
> random intervals (based on when the application initiates a connection to
> previously unknown (or at least forgotten) IP address.
>
> Regards, Martin
>
> MartinVisser99 () gmail com
>
>
> On Thu, Dec 31, 2009 at 2:07 PM, mark marek <markmarek1 () gmail com> wrote:
>
> > Why would this time be so high the port utilization is almost nothing.
> >
> > 6573    0.466959    Cisco_68:1f:1f    PVST+    STP    RST. Root =
> > 8192/0/00:15:c7:6b:03:e6  Cost = 3  Port = 0x8682
> >
> >
> > I attached a screenshot but if it's tripped here is a picture.
> > http://tinypic.com/r/25uhesz/6
> >
> > Also some arps are high too
> > 2345    0.437217    Cisco_6b:00:00    Broadcast    ARP    Who has
> > 192.168.30.39?  Tell 192.168.1.2
> >
> > ___________________________________________________________________________
> > Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> > Archives:    http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> >             mailto:wireshark-users-request () wireshark org
> > ?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe