Wireshark can only capture traffic as it is seen at the point where it is taking the capture (or where the capturing device was taking the capture if another tool is used for the capturing).
Basically this problem has 3 area's:
- The network of the client
- The Internet
- Your network
As you have control over your network, you can start by capturing the traffic for this particular client on your side. Capture at the edge of your network (just after the traffic came from the Internet into your network. By analyzing the specific problematic POST within the captured data, you can determine whether the delay is caused within your own network or not.
If not, have the customer make a trace in their network, again, just before going onto the Internet link. By analyzing the specific problematic POST within the captured data, you (or they) can determine whether the delay is caused within their network or not.
Of course it would be best to make these two traces at the same time so the actual traffic can be compared.
After this exercise, you at least know who is responsible for this issue. If the problem lies in between your networks, then your client needs to contact their ISP to repeat this process up the stream until it is clear where the problem is caused. But usually it is caused within the networks of one of the two endpoints.
