Wireshark-users: Re: [Wireshark-users] wireshark throughput calculation

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Mon, 8 Jan 2007 14:03:49 -0800

On Fri, Jan 05, 2007 at 03:26:02PM +0100, To Van Phu wrote:

> Can someone explain how Wireshark calculates the throughput displayed 
> in the TCP Throughput Graph? It's calculated for each packet --> 
> packet size/ time interval but which time interval does it take to 
> give the result?
> 
> Is it the time elapsed since the previous packet?

Yes.  This is the relevent code from gtk/tcp_graph.c in function 
tput_make_elmtlist():

	double time = tmp->rel_secs + tmp->rel_usecs/1000000.0;
	dtime = time - (oldest->rel_secs + oldest->rel_usecs/1000000.0);

	sum += tmp->th_seglen;
	tput = sum / dtime;

That code appears to be taking the initial time of the current packet 
then the delta time (dtime) is initial time minus the time of the 
previous packet.  Then sum is the tcp segment length and throughput 
(tput) is the segment length divided by the time delta between packets.


Steve