Wireshark throughput comparison
I performed a download throughput test with a mobile handset under LTE network, catching the following logs:
- L1/L2/L3 log with proprietary vendor device's logging tool
- Wireshark log with tPacketCapture app installed on the handset
The test has been performed downloading 6 files in parallel by using HTTP protocol, so 6 TCP threads have been opened by the device. Throughput has been calculated in two ways:
- L1 throughput: by logging tool, at layer 1 level, summing the total downloaded bits (from Transport Block Size in LTE PDSCH) and dividing by the time --> about 60 Mbps on average (out of 5 test attempts)
- Wireshark throughput --> opening caught *pcap file on Wireshark and getting the throughput filtering by source IP address (server) & destination IP address (mobile handset) and going to "Statistics --> Capture file properties" --> about 90 Mbps on average (out of 5 test attempts)
I expected a similar throughput value for both ways, since also Wireshark sums the total bits and divide them by time, or at least L1 throughput slightly higher than Wireshark throughput, which is calculated at a higher layer (IP layer, plus 14 byte of "Ethernet header" for each packet).
Why wireshark throughput is higher than the L1 one? Is there any overhead or any data counted twice, taken into account by wireshark that I didn't filter out?