I would like to know the Total content size and Total time taken to load a particular Webpage in Wireshark. The time parameter in Wireshark shows either time elapsed from first frame or previous frame. How can I obtain the above parameters using Wireshark? asked 02 Feb '12, 11:17  Rhiya edited 02 Feb '12, 11:28  multipleinte... |
2 Answers:
I would suggest using the Firebug plugin instead. answered 02 Feb '12, 13:49  naskop |
If there is only one TCP connection to the webserver I would filter for that and then either look at the summary statistic, which tells you all you need to know or if the connection is held alive for a longer idle time set a time reference on the SYN or the first GET request (your choice) and look at the relative time of the last data packet from the server arriving. If there are multiple sessions to the webserver you can try to set the time reference on the first SYN packet and then filter for your IP and the servers IP and jump to the last data packet or your last ACK to the server and again look up the time it took at the relative time. Regarding content size: Configuring cumulative bytes gives you a good hint on how much data (including per packet overhead) was transmitted in both directions. If you just want the downstream data, you'd have to filter on only webserver sourced packets with tcp.len greater zero and roughly substract the headers. answered 06 Feb '12, 04:55  Landi edited 06 Feb '12, 04:57 Thank You , I have followed a different approach meanwhile. Could you please tell me if this is correct? Right Now I am filtering all Http packets and computing the summation of "Content-Length " field of Response packets based on URL ( i.e Http Host name). I am also calculating the time based on the difference between first GET and the Last Response received for that URL..Is that a correct way to do? But the problem is, I am unable to identify the instance at which the Webpage would be refreshed.As in Start the capture -> You hit www.google.com from your web browser ->Hit www.facebook.com ->www.google.com->Stop capturing. How can I get the packet which again requests for www.google.com for the second time, as it is not possible to tell just from Host name field of HTTp (09 Feb '12, 14:07) Rhiya |
Would you mind updating your answer to explain how to use firebug to accomplish this?
In Firebug, simply open the Net tab and reload the page. It shows the load time of every object (css, js, html, etc.), and the total load time is shown at the bottom of the tab.
Chrome has a similar tool that's built-in. The total time is shown at the top in the timeline bar, farthest to the right.
Thank You , But I actually need to code a java program to find the Time from my saved Pcap file. Can you please let me know if it is possible with wireshark file.
Thank You :-)