Wireshark · Wireshark-users: [Wireshark-users] VNC playback

[Jonathan Polacheck <jonpol@xxxxxxxxxxxxx>]

Hello all,

I need to correlate "user experience" with trace data. For instance, we 
use an ASP that sends data over TDS to a custom client over dedicated 
bandwidth. I get all kinds of "performance" complaints. At least once 
the fix was a Central Office that our MPLS provider works with. Other 
fixes were at the desktops and others were at the ASP.

But I often have to analyse traces on applications I have no personal 
experience with and mediate between the end users who are reporting the 
problem and the developers (both internal and external) that might 
actually have a clue as to what the traffic I see is doing (or not doing).

Having a record of the desktop that generated the client side traffic 
would be a great help in both understanding the problem and getting the 
developer pointed in the right direction.

I have looked at some screen capture packages, but they are clumsy to 
use and place too much overhead on the desktop (cpu, ram and disk). I 
have used VNC and watched myself, but a playback would be much more 
effective.

There are some open-source efforts to get VNC playback, but so far I 
have been unable to get any of them to work. How cool would it be to be 
able to playback VNC data right from the trace that has the 
client/server traffic? And frame numbers to show the exact correlation 
between traffic and desktop events!?

Wireshark does VOIP playback now.  rfbproxy does VNC playback from it's 
own file format.  It seems like all the pieces are available.

I think this could be a quantum leap in my ability to both document and 
diagnose end user issues. What do you think?