Wireshark 101: Understanding High Latency, HakTip 136

[@danieldavis4187]

I'm pretty sure the time field is just when the packet arrived (measured in seconds relative to the first packet of the capture). It's not the "latency" of the captured packet. If you want the latency of an HTTP server, you'd need to look at the difference in time between a request packet its associated response packet.

[@DanOC1991]

Check the source and destination, these are the request and response packets and hence the difference between them is the lag.

[@jasperbongertz4866]

The verdict on example 2 sounds a bit hasty to me. Stating that this is caused not by client or server but being "wire latency" doesn't make much sense, unless the term "wire" is supposed to also include devices like firewalls, routers and other middle boxes (you can safely ignore switching delays, which lies in the 100 microsecond range). Pure transport speed is about 200,000 km/sec on a wire, so 1 second would be enough to go around the world about five times. So if there's delay it's either the server (very likely) or a network device in the middle (rare). The capture was obviously taken on - or very close to - the client machine (determined by looking at the three way handshake delta timings), so it's hard to say what caused it without having a capture taken at the server at the exact same time. Without the server capture, the verdict should be "not the client, maybe the network, but probably the server". Unless you know something we don't, like having introduced an artificial delay (e.g. using netem on a linux router box) for the purpose of the capture :-)

[@vadlowperminov5215]

Shannon you unbelievable, thx for HakTip.

[@derajkumar123]

I want to introduce network latency between windows and Linux machine which should be customizable say 100ms , how do i do it ?

[@haze42082]

I like to keep my baseline clean, d'uh like I totally knew that. When I use my latency with the baseline wireshark kicks in for 1 second data packets. Furthermore I would like to add my http is latent with the network modulator included, thank you!

[@satishchowdaryp]

Is there any tool that can track the network through which the packets reaches the target and give full details about the network devices (routers, switches,Etc)

[@MsSpy109]

Not the best haktip. Could of gone into detail with the tools wireshark has for detecting top talkers and delta/jitter. But it did get the general idea across. This stuff is gold when trouble shooting voip call quality fellas!

[@Hari-ed5es]

its really bad, what you have explained here?

[@AndyPayne42]

Few things: One really good reason to check latency is if you think someone is in the middle of you and the server which will increase latency. I recommend codebender.cc for sharing or embedding arduino code w a simple html tag -- I like it cause all you need is a browser. And funny how there is more "shared on google+" comments than actual comments lol the world is a changin

[@S.C.D.]

OMG, that sounds like work...

[@cooper01236]

party?

[@haze42082]

I think I watch these vids because of the name hak5. Other than that everything is way over my head, and I have no idea what their talkin about....pretty sad. They need like a hak0 for complete noobs. I'll probably be hacked just for posting this comment.

[@FFxO]

BHayes82 haha