When I limit the capture of packet to about 100 bytes (paer packet), there is visible change in throuput measurement (as indicated in the summary). Why would this happen?

asked 13 Jan '11, 01:28

Raghav's gravatar image

Raghav
1111
accept rate: 0%

Can you describe the actual difference (and confirm the traffic you are monitoring hasn't changed)?

That sounds like a bug.

(13 Jan '11, 03:03) martyvis

The only thing I can imagine is that as soon as you limit the frame size to say 100 bytes that your throughput get better (you didn't mention if it goes up or down, but I think "up" is the only realistic thing to happen).

This is why: your link might really really be crowded with frames, and when Wireshark tries to capture those there is too much data too fast to be written to disk, resulting in dropped frames. As soon as you reduce the capture size to 100 byte there is much less data volume to be written to disk, so Wireshark can "record" more frames, and this results in a higher throughput reading.

If your throughput readings go down on 100 bytes per frame I'd agree with Martyvis that this is probably a bug.

link

answered 13 Jan '11, 12:00

Jasper's gravatar image

Jasper ♦
10.1k328145
accept rate: 15%

I would imagine that it is actually calculating this based on the frame as seen in the capture. You could still get some idea of usage by opening "IO Graphs" under "Statistics". Set the units to "Advanced" and use Sum(x) and ip.len. Its a different view, but should be relative to frame size and throughput as long as most of your traffic is IP.

link

answered 13 Jan '11, 02:55

Paul%20Stewart's gravatar image

Paul Stewart
2868
accept rate: 6%

I experimented with this unscientifically and without a huge load. I actually found that only the "File" section of the summary screen seemed to be affected by limiting the packet size. I ran two instances of wireshark for about the same amount of time. The Avg bytes/sec were pretty consistent between the copy that was limiting the packet size and the one that wasn't. The pcap format might actually have a field for frame length even when it does not record the entire frame. I'm using 1.4.2.

link

answered 13 Jan '11, 13:19

Paul%20Stewart's gravatar image

Paul Stewart
2868
accept rate: 6%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×94
×21

Asked: 13 Jan '11, 01:28

Seen: 1,387 times

Last updated: 13 Jan '11, 13:19

powered by OSQA