Measuring latency using timestamps.

asked 2022-10-14 14:38:36 +0000

nifty
3 ●2

updated 2022-10-14 23:53:54 +0000

Guy Harris
19890 ●3 ●660 ●207

I want to measure the latency of packets from client to server rather then the RTT. SO I send some tcp packet to server and running Wireshark at both the client and server. My thinking was that I can easily measure latency using timestamps but the Wireshark at the server side also shows the timestamp zero when the packet arrives at the server. I want it to be the same as in client( at client side the timestamp is zero make sense, but at the server side it should be time it take to travel from client to server). How can I solve that problem, if not what would be the other ways to find the latency. Thank you

Comments

What do you mean when you say that the timestamp is zero?

Time stamps in packet capture files are usually absolute times; in both pcap and pcapng capture files, which are native formats for Wireshark, they represent units of time since January 1, 1970, 00:00:00 UTC, so a numerically-zero pcap or pcapng timestamp means the packet was sent or received back in 1970.

Guy Harris ( 2022-10-14 16:54:07 +0000 )edit

Thanks for the response. The first SYN packet contain timestamp zero as shown below at both the client and server,

[Timestamps]
    [Time since first frame in this TCP stream: 0.000000000 seconds]
    [Time since previous frame in this TCP stream: 0.000000000 seconds]

Exactly, I want timestamps value in UTC so that I can measure the latency of packet by subtracting the timestamps of packet at client and server side ( I am running Wireshark at both machines and also synchronize both with the common NTP server).

nifty ( 2022-10-14 17:13:53 +0000 )edit

add a comment

answered 2022-10-14 22:50:21 +0000

Guy Harris
19890 ●3 ●660 ●207

The first SYN packet contain timestamp zero

That's because you're looking at the "time since first frame" and "time since previous frame" values. Those are NOT the time stamp of the packet in the capture, those are:

the difference between the time stamp in the capture for the packet you're looking at and the time stamp in the capture for the first packet in the TCP stream, as indicated by "Time since first frame in this TCP stream";
the difference between the time stamp in the capture for the packet you're looking at and the time stamp in the capture for the previous packet in the TCP stream, if there is one, as indicated by "Time since previous frame in this TCP stream".

As this is the first SYN packet, it is the first packet in the TCP stream, so the first difference is guaranteed to be zero, and it has no previous packet, so the second difference is reported as zero.

I want timestamps value in UTC

Then what you want to do is:

from the View" menu, select the "Time Display Format" submenu and, in that submenu, select "UTC Date and Time Of Day (1970-01-01 01:02:03.123456)";
look at the "Arrival Time" entry under the "Frame N" item at the top of the packet detail display, rather than anything in the TCP information.

edit flag offensive delete link

Comments

Thank you for the guidance, some further question related to it.

The Arrival time shows the time and date which is fine, but is the Epoch value is the same date and time but in the seconds from 1970 UTC? Can I use Epoch value as a time?
Arrival Time: Oct 15, 2022 11:18:03.993296000 W. Europe Summer Time [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1665825483.993296000 seconds
Is my way of measuring latency is fine by using these Epoch values and subtract the Epoch value the time packet transmit from client to the Epoch value the time it arrived at server?

nifty ( 2022-10-15 09:24:57 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Measuring latency using timestamps.

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Measuring latency using timestamps. edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Measuring latency using timestamps.