Wireshark Tutorial // Fixing SLOW APPLICATIONS

In a large trace file with lots of connections, how can you find the slow ones? I'd like to show you a trick I use when digging for pain points in the trace. Follow along by downloading the trace below!
Click here: www.cloudshark...
Like/Share/Subscribe for more Wireshark content.
== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywi...
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtual...
== Private Wireshark Training ==
Let's get in touch - packetpioneer....

[@donniereidjr]

Your Foundational TCP Analysis With Wireshark course on Pluralsight is amazing sir!

[@ChrisGreer]

Thanks for the comment Donnie! If anyone else wants to check it out go to bit.ly/wiresharktcp

[@punggukbulan8674]

I have watched 90% video created by chris in pluralsight..mastering tcp, visualize tcp, etc..all are amazing..:), and now i am waiting his video about analysis voice/video over apps (whatsapp,etc) in pluralsight...great job chris.!!

[@PeterTeehan]

@@punggukbulan8674 or Teams? Hummm

[@misha2082]

Why would someone downvote this content? KZbin should remove that option completely, it brings only negativity.

[@ChrisGreer]

Thanks for the kind comment Mykhaylo. Yeah not everyone wants to learn how to troubleshoot TCP I guess!

[@ПетърШопов-й7ч]

Very useful video, highly appreciated! You've just saved my job! :)

[@b3b3chaud]

I can't find the right traduction in french for packet head. Lol This is good infos, thank you.

[@ירוןגולן-ב8צ]

Hello chris you know about NAGL algo'?

[@sujitharajan6468]

@sujitharajan6468 0 seconds ago Hi chris, thank you for this amazon work. At @3:42 around when you add TCP delta and sort you see 19 sec delay packets. You said that this is in consideration with the above TCP packet whereas the before sort gave a 1 second delta. How is it that if two packets has a 19 second delay between them that is not shown while sorting time delta ?

[@ArunKumar-o8i6m]

Hello Chris, TCP delta is fine but how you add delta Kindly help

[@buzooliibrahim8382]

how do you get the delta column plz explain or provide if u have any related video thx

[@rougearlequin]

Tcp delta in this stream. Column. Sort.

[@cabsandy]

top banana chris-think I'll do a dump off my home router and see if I can find a "slow" server :-). Keep up the good work!

[@ChrisGreer]

Awesome! Go for it. Report back if you find anything interesting.

[@amitkoren948]

Am i wrong saying i can just have a column for 'delta time displayed' and then do 'follow tcp stream' to achieve the same thing?

[@ChrisGreer]

You could, but when you are working with a multi-threaded application or several TCP connections in parallel, it's harder to find the delays because you have to filter the streams one at a time. A TCP Delta column lets you see the delays in context, without needed to filter the connections one at a time. So in short, in a pcap that only has one or two connections - the delta time displayed would be ok with a connection filter. But any more than that you can speed your analysis with a TCP delta column.

[@amirahmed1404]

You’re the MAN, Chris. Thanks a lot for these great tutorials.

[@ChrisGreer]

Thanks for the comment Amir! I appreciate the positive feedback.

[@hackebeil20]

Ha! 30 seconds in and already learned something! I usually filter out one conversation first and then check on the deltas but this way around can help if you don't know where the baddies are at.

[@ChrisGreer]

nice! yeah I used to do that too until I found this little trick. Now no need to filter on those conversations.

[@B-Billy]

Hussein Nasser recommended your channel.

[@ChrisGreer]

Welcome Mehraj - great to have you. Hussein is awesome.

[@jimmywang100]

Hi , i just downloaded wireshark 3.6.3, i do not see Delta in my column .. how do i add that delta ?

[@ChrisGreer]

Hey Jimmy - I walk you through that here - kzbin.info/www/bejne/hYaQcmV7orulgbM

[@Joallyson]

Love this Chris, you explain very well! It's gonna help me a lot on my job. I just want know where did you get the 163ms? Thanks

[@overtheedge107]

It comes from the delta column. Time displayed is in seconds. .163 seconds equates to 163 milli seconds.

[@JohnnyLeuthard]

I love your videos. Wireshark has always been an overwhelming application. It can feel like you are drinking from a. firehose and there is so much chatter. After just watching a couple videos it has already boosted my confidence and given me some skills to filter out the noise to find the info I want. I will continue on with the rest and i am also working through some of the Pluralsight classes you authored. The best part of these youtube videos, at least for me, is it's broken up into small bite size tasks. If i want to know how to do a particular task. Like this video i can find the one I want and quickly figure out how to get what knowledge I need and want.

[@ChrisGreer]

Wow thanks for the feedback! I will keep up the content. Thank you.

[@tonichard6564]

Wow this is great! This will help so much at work! Thank you for sharing your knowledge!

[@ChrisGreer]

You're so welcome! Thanks Toni.

[@Rafael-zc6xy]

Your channel has a lot of very useful information. I'm watching all the playlists! Thank you for sharing your knowledge with us, Chirs!

[@ChrisGreer]

Thank you! Like, please share on social media, and by all means subscribe!

[@yohanmeier6061]

Hello Chris is good technical, i use technical last week for timeout application, i difficult tow sessions stream, one session client with load-balancer and second session lb with backend server. Very practice technical ;-)

[@ChrisGreer]

Awesome Yohan! Keep up the practice.

[@yohanmeier6061]

@@ChrisGreer thank you Chris, I work on wireshark every day my job , it's a real passion, because it allows you to learn a lot of things. it's a shame that in France computer studies do not focus on the analysis of network traces with wireshark

[@catbuddycatrescue2081]

Thank you never been able to work out how to do a latency test with W/shark - really helped clear up a lot my confusion.

[@abylaurancecherian4930]

Thanks Chris. Wonderful tip :)

[@ChrisGreer]

Thanks for the comment Aby!

[@hcetc]

I love these videos Chris! Thanks man. And keep up the great work.

[@ChrisGreer]

Glad you like them! Thanks @Samuel.

[@senorhotspot]

Love it. This helps a lot. Thanks. Keep the videos coming.

[@ChrisGreer]

Thanks, will do!

[@alugupavankumar5649]

I don't see a apply as column option when I right click on the packet. Is tht any such new update with wireshark?

[@ChrisGreer]

Hmm... that is a pretty standard feature. Try right-clicking something in the detail pane and not the summary pane. Like an IP address or a Length field.

[@arunRaj-jl1lv]

@@ChrisGreer Same i couldn't see at 4.2 version.

[@adumule431]

hi can we see the user id and key of a website through Wireshark

[@ChrisGreer]

I think you are referring to user ID's and passwords? Generally no since most of that is encrypted, unless we have stored the session keys and they are exchanged in clear text. Protocols like telnet and FTP still allow you to see them though.

[@israelavivi6202]

hello how can i download the pcapng file to work on it ? thanks

[@ChrisGreer]

Click on the link in the description - go to Export - Download File.

[@senthilchily]

nice video love it

[@venkateshvr1246]

Thank you Chris for sharing your knowledge.

[@MiDeubi]

Very nice !!! Thanks for sharing ! Awesomely

[@mmaranta785]

Packetheads!

[@EzhegAB]

Thank you for the video! Everything is clearly explained

[@shervinhariri6821]

Thanks for your awesome explain

[@patmarek1222]

Ah man less than 9 minutes and so much golden knowledge on how to approach this. Actually watched twice to fully understand cause I'm sleepy af this morning :D Thanks, I'm definitely subscribing!

[@ChrisGreer]

Thanks and great to have you here!

[@Comedypandemic]

David is the reason I am here

[@ChrisGreer]

Welcome!

[@Be-Kind-Be-Gentle-Be-Just]

Thank you. You have earned my subscription and like. Well done

[@ChrisGreer]

Awesome, thank you!

[@ranjanadissanayaka5390]

amazing video.thanks Chris.

[@mohdkhairulezmicheseman2435]

im always watching your video when bell is pop up..this time not skipped advr

[@ChrisGreer]

Hmm, not sure what the problem is. Can you give more detail?

[@oneyeartomaster5695]

is there any way to decrease that TCP Delay ?

[@alextimmermans5122]

Thank you , Chris , for yet another informative video. You got some more ? ;-)

[@ChrisGreer]

More to come! Stay tuned @Alex!

[@felipeoliveira895]

Amazing videos and courses! Do you plan to record any sessions or courses on BBR? That would be awesome! Thank you so much!

[@ChrisGreer]

Hello Felipe, thanks for the comment! I don't plan on any BBR specific content for now. Just because it is such a niche topic - however I do talk about it a bit more in my Virtual Wireshark course. Links in description.

[@realstevelknievel]

You're the GOAT man! Thanks for all your content!

[@ChrisGreer]

Thank you for the kind comment!

[@brahmadude8955]

Master is back😘❤️🙏

[@ChrisGreer]

I'll keep them coming! Thanks for the comment.

[@plautod]

Great video. I'm sharing this with my network team!

[@ChrisGreer]

Please do! thanks!

[@ejeangilles]

Awesome as usual! Can you also do a video on decrypting traffic in trace file.

[@ChrisGreer]

Hey Edwin - yes, I have had that one on the docket for a little while. I will get it done soon!

[@yellajatinswaroop4905]

Thanks sir ,Great video, it would be helpful for us , if u start making a youtube series on wireshark,just like David Bombal & Network Chuck for CCNA Tq sir

[@ChrisGreer]

Thanks for the comment Yella - yes that is definitely on my mind to do. A more comprehensive course for Wireshark here on KZbin. Let me know if that sounds interesting to you all out there!

[@alextimmermans5122]

@@ChrisGreer Yes, please !

[@PapaManixs]

Echoing Yella, for sure!

[@yellajatinswaroop4905]

Plz sir !

[@skeetabomb]

Great stuff

[@Black_Swan68761]

You are Amazing, Chris!

[@ChrisGreer]

Wow, thank you!

[@maitongm]

Great video

[@ToddMagers]

Great video Chris!

[@punggukbulan8674]

Thanks Chris...wish u all the best

[@ChrisGreer]

Thank you!

[@janekmachnicki2593]

Chris you are amazing engineer .Any more courses on Udemy ?

[@ChrisGreer]

I have one planned around nmap. Hoping to get it shot and edited in December.

[@janekmachnicki2593]

@@ChrisGreer Great !! Always is best to learn from the best .Greetings fom Brum

[@PapaManixs]

Chris! - Always get super excited whenever you upload a new video, this channel is the sole reason I got into Wireshark - you got a way to make it super fun and presentation is top notch! -- Really appreciate all the content and work put into it!

[@ChrisGreer]

Wow, thanks for the comment! Also for the positive vibes. Helps me think of new content to get out there for you guys. Thank you I appreciate it.

[@rajesh_shrestha]

same here always waiting for new videos to come out, so that i can learn new things. like this one :)

[@rohityadav992]

After long time Mr. Packet 😀 again great one👍

[@ChrisGreer]

I'm back Rohit! Thanks for the comment.

[@rohityadav992]

@@ChrisGreer indeed your content is best in deep analysis...keep it up 🤝

[@koushikkumarboah2745]

Amazing content!

[@ChrisGreer]

Appreciate it!

[@johnp1]

Very good tip!

[@ChrisGreer]

Glad you think so Duc!

[@ericksonjosephsantos1964]

great stuff!

[@ChrisGreer]

Thanks!