Wireshark-users: Re: [Wireshark-users] Spanning tree can slow the network?
From: Jim Aragon <[email protected]>
Date: Sat, 14 Jul 2012 21:21:49 -0700
At 10:41 AM 7/14/2012, Andrea wrote:

> Hello Jim, here is my first cut of tracefile:
>
> http://www.cloudshark.org/captures/4b8cf621d044
> It contains conversation from when I first start application,
> and on row 717 there is first spanning tree.

Ok, let's take a look at this data.

There are 8 STP frames in this trace file: Numbers 1, 2, 57, 61, 258, 717, 776, and 6254.

You said there was about a one-second delay between an STP and the next packet from the server (192.168.1.2). So let's look only at STP frames and TCP packets FROM the server. Our display filter is "(tcp  && ip.src="" || stp". The time delays between each STP frame and the next TCP packet from 192.168.1.2 are:

After frame 1: No traffic, and our application hasn't started yet.
After frame 2: 0.504272 seconds, but when we see frame 2, our application hasn't started yet, so we don't count this.
After frame 57: No traffic between the STPs in 57 and 61.
After frame 61: 1.557721 seconds
After frame 258: 0.054305 seconds
After frame 717: 0.690998
After frame 776: 0.059590 seconds
After frame 6254: 0.000001

The average of these delay values is 0.472523 seconds. Yes, we have one value that's over a second and a half, but we've got three values that are under 0.06 seconds.

I don't see a consistent one-second delay. In fact, this looks pretty normal to me. I think you're just seeing the normal variation of network traffic. Sometimes there are pauses in the communications for various reasons, but they are unrelated to STP.

Jim