The biggest problem with determining the differences is that all your traffic is encrypted in SSL (HTTPS) so we can't see the actual transactions.
However by inference, the client is clearly operating differently.
The most obvious thing is the total amount of traffic (seen if you view the Statistics:Summary) the number of packets and bytes is just about double on the Loadrunner example. But I guess you already knew that
However the most telling thing can be seen from Statistics:Conversations and TCP. The manual only had 2 HTTPS sessions established. Both seem non-trivial (in terms of the volume of traffic). However for the loadrunner test there are 13 HTTPS sessions. Some of the loadrunner driven sessions have very little traffic, with only 1K or two going each direction.The last two established SSL sessions seem to match the volume of your manual test.
So there is a clear difference in how the two operate. What that is can only be determined either through not using HTTPS (or decrypting the HTTPS) or using suitable browser or server analysis tools (something like Firebug in the former, and log or debug tracing on the server.
Regards, Martin
MartinVisser99@xxxxxxxxx
On Wed, Mar 3, 2010 at 11:40 PM, Mahendranath.N
<mahendranath_n@xxxxxxxxxxx> wrote:
Hi Martin,
Please find the attched wiresharkl files captured during navgation of same flow manually & by load runner.
manually we observed 161 entries and when we capture the same process by load runner we observed 369.
We made sure there is no extra browser or extra software running n the system.
Please find the attchment for both the files. Info ont he extra entries during load runner capture will help us greatly.
Regards,
From: Martin Visser <martinvisser99@xxxxxxxxx>
Subject: Re: [Wireshark-users] Wireshark trace file for load runner events
To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
Date: Tuesday, March 2, 2010, 8:32 AM
Mahendranath,
You need to provide a little more info for us to help.
I am sure that "Ethernt 2, src : HewlettP_5c:80:39" isn't all that appears the information on the packets you are seeing. The best guess is that "Ethernet 2" is the name of interface and that "HewlettP_5c:80:39" is simply the source MAC address of the packet (where the first 3 bytes of the actual MAC address xx:xx:xx get resolved to HewlettP")
I think we would need to see a well-filtered sample of the packets from your manual and Loadrunner scenarios to be able to compare. (Loadrunner tries to "emulate" clients so it simply might be not be a perfect emulator)
Regards, Martin MartinVisser99@xxxxxxxxx
|
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
