Ask Your Question

My I/O Graph Window Doesn't Look Like Laura's

asked 2022-05-07 14:07:24 +0000

ajaznawaz gravatar image

updated 2022-05-07 14:07:51 +0000

I was watching Laura Chappell's YouTube tutorial and under Statistics / IO Graphs, my window looks different. I am missing the 'Graph' and 'Filter' buttons.

I did some analysis work into the late hours last night and wanted to bar-chart the output if possible, but I have not clue how-to atm.

I wanted to illustrate TCP delays observed.

Problem begins at line No.104 (left side column) highlighted in BLUE - client sends a TCP ACK to the SQL server (, having received a 'Response' message containing 43bytes (see TCP segment column). The client hears nothing back from the server and waits just under 30sec (i.e. session timeout value) before sending a TCP Keep-Alive "hey Mr Server, are we still talking" The server responds immediately with TCP Keep-Alive ACK, to say "Yes I am here, just waiting for application (i.e SQL) to prepare next piece of data (SQL batch) for sending back to you, so please wait" The server then decides to send a TCP Keep-Alive to the client almost immediately which is odd behavior since it is nowhere near a reasonable TCP timeout value (in seconds) Nonetheless, the client responds right away and awaits further communication to be received - see line No.294 The client waits (hanging) for another ~30 secs, nothing is received so it once again sends TCP Keep-Alive - see line No.445 The cycle continues in this way between the two end-points with no attempt by either side to terminate the conversation The findings point to a catastrophic defect at the application layer of the OSI model in the way this particular session was handled When comparing the 'working' captures and 'non-working' I noticed the ACK following the TLS exchange was opposite in terms of who end sent it. Notwithstanding, we see 'SQL batch' and 'response' so it would be reasonable to conclude the TLS handshake and setup succeeded.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-05-07 18:10:37 +0000

grahamb gravatar image

The video is showing an old version of Wireshark and the UI has been improved, hence the "missing" buttons. The Wireshark User's Guide has help on the I/O Graph here.

edit flag offensive delete link more


Feb 27, 2014 is rather a long time ago. Not sure which version was hot at that tme. But these video's are more about grasping concept and then apply them yourself.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2022-05-09 07:40:30 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-05-07 14:07:24 +0000

Seen: 105 times

Last updated: May 07 '22