I have a trace with a single source ip address talking to several destination ip addresses. I need a report or graph that shows the http response times for the source going to each dest ip. I need to know who the fastest and slowest servers are when communicating with this ip address. How can I do this? Thank you.
asked 22 Feb '12, 22:11
It isn't very easy but it can be done.
You need to divide up your HTTP traffic into separate TCP streams and then report on each of them. This is because we are are going to use the ability for wireshark to calculate and display times (deltas) between displayed packets. This only works if you have a single TCP stream in the display.
Note that because by default Wireshark will reassemble multiple TCP segments, displaying the last frame in the response, your default response graph will show the Response Time for the last byte (or at least the last frame). If you want the response time for the first byte (which gives you a better idea of the server processing time, and doesn't include the delay in streaming the whole response), you may want to go into your Preferences->Protocols->HTTP and turn off reassembly. Note that if you do this you should use the filter "http.request && http.response" rather than just "http" to avoid seeing all the in-between frames.
You can see the difference here in the following two graphs (from Australia to the BBC web site for images)