Wireshark
the world's foremost network protocol analyzer
Wireshark-users: Re: [Wireshark-users] timestamp fields and RTT calculation
From: Martin Visser <martinvisser99@xxxxxxxxx>
Date: Tue, 8 Dec 2009 07:43:59 +1100
RTT is the difference in capture time of TCP frames with a certain SEQ and then corresponding followup ACK from the receiver. (Unfortunately sometime Wireshark gets this wrong particularly where later where zero length segments are involved.)
Regards, Martin
MartinVisser99@xxxxxxxxx
On Sat, Dec 5, 2009 at 2:32 AM, hne <haneugen@xxxxxxxx> wrote:
Hi,
again a question about tshark, are there fields containing the TSval and TSecr Values which are part of the Timestamp option, which could be added to the field list using
tshar -r File -T fields -e ... ?
Furthermore how does tshark calculate the value of tcp.analysis.ack_rtt?
Cheers.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
- References:
- Prev by Date: Re: [Wireshark-users] Number of connections to host IP address?
- Next by Date: Re: [Wireshark-users] Number of connections to host IP address?
- Previous by thread: [Wireshark-users] timestamp fields and RTT calculation
- Next by thread: [Wireshark-users] Wireshark hangs Ubuntu 9.10
- Index(es):