Slow download

asked 2020-02-25 23:28:15 +0000

sharkTANK03 gravatar image

updated 2020-02-28 20:02:14 +0000

Hello

I am new to Wireshark. I am trying to understand why my download speed is slow and I did a capture while downloading a file that is around 20MB. I attached my capture here - I did not notice any anomaly but I was wondering if someone else has any hints of a problem. Thank you

Here is the link to my file: https://1drv.ms/u/s!Atp-rezKrkTGgRjA8...

edit retag flag offensive close merge delete

Comments

could you publish the capture, login-free, somewhere like at DropBox, Google drive, MS One drive... and edit your Question with a link to it?

Chuckc gravatar imageChuckc ( 2020-02-26 01:13:55 +0000 )edit

Did it now, thank you

sharkTANK03 gravatar imagesharkTANK03 ( 2020-02-26 17:23:22 +0000 )edit

tcp.stream eq 9 and tcp.srcport==443

Chuckc gravatar imageChuckc ( 2020-02-27 02:46:44 +0000 )edit

TCP stream 9 has most of the packets.
Apply the display filter above and look at the capture file properties.
Looks like ~110MB downloaded over ~90 seconds at a rate of about 10Mbit.

Chuckc gravatar imageChuckc ( 2020-02-27 02:49:58 +0000 )edit

Right, so that would be around 1.2MB/s. I guess nothing out of the ordinary here that would tell us why it's slow

sharkTANK03 gravatar imagesharkTANK03 ( 2020-02-27 21:54:31 +0000 )edit

"a capture while downloading a file that is around 20MB"
The capture is 110MB so 5.5 times expected data?

Chuckc gravatar imageChuckc ( 2020-02-27 22:40:51 +0000 )edit

Can you please do the capture once again but start the wireshark before to get 3 way handshake - to see negotiated options. What is your bandwidth?

szparaq gravatar imageszparaq ( 2020-02-28 11:39:46 +0000 )edit

Pfft, very sloppy of me - I uploaded the wrong file, sorry about that. Thanks for catching that @bubbasnmp. I have updated the link now

sharkTANK03 gravatar imagesharkTANK03 ( 2020-02-28 20:02:46 +0000 )edit

As @szparaq mentioned, it would be nice to have a capture with the TCP handshake.
Until then, here's what I see - not sure what it is.

If you add a column for tcp.segment.count, set a display filter for tcp.segment.count>0 then scroll down and look at the segment counts > 10.
A good example is frame 930. 21 segments of almost random sizes.
(Expand the Reassembled segments line in the Packet Details.)

Chuckc gravatar imageChuckc ( 2020-02-28 21:25:39 +0000 )edit

My comments (helpful or not):

  • client IP address 250.x.x.x is unusual
  • max TCP length is 1238, so MSS is apparently quite low (as mentioned, TCP handshake would be good to have)
  • yes, strange looking segmentation, like 13+1238+226 = 1477 bytes
  • bytes in flight does not go very high
  • from frames 20 and 23 I guess the RTT is about 55 ms
Markku gravatar imageMarkku ( 2020-03-01 10:18:13 +0000 )edit
add a comment