Answers to: Microburst analysis for wireshark<p>Hello,</p> <p>I am suspecting microbursts happening at time intervals too short to show up in i/o statistics in some pcap files.</p> <p>Does wireshark have built-in automated search through large captures to find microbursts?</p> <p>Is there a way to get a better resolution than 0.001s in i/o Graph ?</p> <p>Thanks.</p>enWed, 11 Jun 2014 13:52:34 -0700Answer by audyn<p>this is more of an answer and a comment.</p> <p>the question i added to the comment was basically one that answers what we're trying to actually gather from io graph.</p> <p>So interestingly one way we could use the IO graph is for example: you get some spikes here and there and let's say one of the spikes went up to 5000 bits per tick (and you have the tick interval set to 1 millisecond). The way to figure out the bits per second rate is to simply multiply by 1000 (1000milliseconds) and you come up with 5000000 bits per sec (5Mbps).</p> <p>hope that helps.</p>audynWed, 11 Jun 2014 13:52:34 -0700 by Kurt Knochner on audyn's answer<p>is this a comment, an answer or a question?</p>Kurt KnochnerWed, 11 Jun 2014 13:15:34 -0700 by audyn<p>one thing that could be deceiving is when you choose .0001 sec on x axis tick interval in I/O graph, it doesn't really tell you what the bits/sec rate is.</p> <p>at first i had the impression that if you chose .0001sec (1 millisecond) you would see higher spikes than when you chose tick interval of 1 sec. But that's clearly not the case.</p> <p>the reason for this is wireshark is simply telling you how many bits are matched every 1 millisecond, instead of telling you the "rate" on a per second basis. </p> <p>the question is: during this 1 millisecond interval sample, based on the bits that were seen, if we were to have this many bits for 1000 consecutive milliseconds, what would be the bits per second rate. And unfortunately, wireshark doesn't seem to calculate this for us in IO graph.</p> <p>However, you can get a very detailed throughput graph when you go to statistics&gt;tcp stream graph &gt; throughput graph. the only problem with this is it only gives you the stats for the tcp conversation you have highlighted.</p>audynWed, 11 Jun 2014 12:48:24 -0700 by Kurt Knochner<blockquote> <p>Is there a way to get a better resolution than 0.001s in i/o Graph ?</p> </blockquote> <p>well, if you don't see a microburst with a resolution of 1ms, then it is either not there or really, really short (which might be the case). Unfortunately there is no commonly accepted definition for a microburst, at least I don't know one. So it is hard to 'describe/define' what a microburst is and/or what is not, especially as it heavily depends on the environment.</p> <p>As you cannot draw IO graphs with microsecond resolution, your options are:</p> <ul> <li>extend the wireshark code to allow that (may be some work)</li> <li>use tshark to output the data in 'CSV' and then use a <a href="">Spreadsheet software</a> or a tool for statistical calculations (like the <a href="">R language/environment</a> or ) to generate graphs with a lower (or higher) resolution.</li> </ul> <p>Example:</p> <blockquote> <p>tshark -nr input.pcap -T fields -e frame.number -e frame.time_relative -e ip.src -e ip.dst -e frame.len -E header=y -E separator=; &gt; out.txt</p> </blockquote> <p>Regards<br> Kurt</p>Kurt KnochnerSun, 29 Sep 2013 09:19:30 -0700