Re: Question about seeing Latency in TCP conversations

["Sheahan, John" <John.Sheahan () priceline com>]

I have filtered out a single conversation and I have the time display set to “Seconds since previously displayed 
packet”. I want to now add the time field to a graph to show how long it took between packets.

Here is a screen shot of the filtered conversation:

[cid:image001.png@01CCCD20.79021950]

Here is my attempt at adding the Time field for this filtered conversation to the graph which did not work and I’m not 
sure what I’m doing wrong:

[cid:image004.png@01CCCD20.FA4623D0]

Thanks,

johnny

From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Martin 
Visser
Sent: Wednesday, January 04, 2012 5:45 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Question about seeing Latency in TCP conversations

Johnny,

The easiest way is to examine the calculated field "tcp.analysis.ack_rtt". This appears in the details window if you 
have TCP Sequence Analysis on.


[cid:image002.png@01CCCD20.79021950]

You have to be a little careful when using this though, as Wireshark sometimes miscalculates this in the prescence of 
Duplicate ACKs. The best way to use it (taking out effects of the server processing delay), is during the initial 
handshake. So what I do is filter for "tcp.flags == 0x12" (which is the SYN/ACK) and plot tcp.analysis.ack_rtt or add 
it as a column.

[cid:image003.png@01CCCD20.79021950]

Regards, Martin

MartinVisser99 () gmail com<mailto:MartinVisser99 () gmail com>

On 5 January 2012 08:20, Sheahan, John <John.Sheahan () priceline com<mailto:John.Sheahan () priceline com>> wrote:
I have been given a sniffer trace by our application guys and they want me to look through it to see if any of the TCP 
conversations have higher than normal latencies.
The file is kind of big and too much data for me to filter and look at each conversation.

Is there an easy way to do this in Wireshark?

Thanks

Johnny

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org<mailto:wireshark-users () wireshark org>>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request () wireshark org<mailto:wireshark-users-request () wireshark 
org>?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe