Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] Why capture at multiple places of TCP Stream ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Anup Patel <bugzbunny@xxxxxxxxx>
Date: Fri, 11 Mar 2005 15:01:29 -0500
when i merge two captures, will Ethereal automatically indicate
duplicate packets? If I capture the session at three places and merge
them together, will Ethereal show the duplicate packets?

Thanks,
Anup


On Fri, 11 Mar 2005 09:37:36 -0800, David.Kaatz@xxxxxxxxxxxx
<David.Kaatz@xxxxxxxxxxxx> wrote:
>  
> 
> I would say it depends on what you are trying to determine.  If you are
> trying to find out WHERE latency or packet loss occurs, then capturing at
> multiple places can narrow that down.  If only trying to find out IF latency
> or packet loss occurs, then just capturing at one location will show that. 
>  
> 
> Dave 
>  
> 
> -----Original Message----- 
> From: ethereal-users-bounces@xxxxxxxxxxxx
> [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Anup Patel 
> Sent: Friday, March 11, 2005 8:08 AM 
> To: ethereal-users@xxxxxxxxxxxx 
> Subject: [Ethereal-users] Why capture at multiple places of TCP Stream? 
> 
> Hello, 
> 
> I am trying to figure out why would one want to capture at multiple places
> of a TCP Stream? Below is the scenario. 
> 
> Originator of a session ->(Router) intermediate LAN segment ->(Router) LAN
> where the  Application resides on a server (Assume 3 hops) 
> 
> Is there a need to run a capture at each of these locations, meaning on the
> request originator, intermediate LAN where capture will be done by source IP
> address of the originator and next to the application server again capture
> done by the source ip address of the originator. 
> 
> Capture at all three places and than combining those captures? 
> Shouldn't capture at the originator tell me latency, packet loss, etc..?
> What additional data can I get by doing multiple captures? 
> 
> I am looking to timestamp my captures with GPS if I were to do multiple
> captures so it is easier to combine the captures based on timestamps. Should
> I even bother? 
> 
> I am in a bit of technical debate with my colleague who wants to capture at
> all location. 
> 
> What am I missing? Any help will be greatly appreciated. 
> 
> Thanks a Lot, 
> Anup 
> 
> _______________________________________________ 
> Ethereal-users mailing list 
> Ethereal-users@xxxxxxxxxxxx 
> http://www.ethereal.com/mailman/listinfo/ethereal-users 
> "This message is intended only for the named recipient. If you are not the
> intended recipient you are notified that disclosing, copying, distributing
> or taking any action in reliance on the contents of this information is
> strictly prohibited."