[Wireshark-users] (Is this message being received by anyone?) How to interpret RTT graph
(Sorry for duplicates if there are any) Usually I see a copy of my email come back to me when I send an email to a list, but have seen nothing back from the list. I verified my list options, and it seems there might be one that could cause suppression depending on definintions, so I toggled it to see if that makes a difference. Thank-you for your forbearance. I was looking to understand the Round Trip Time graph and why it seems to jump up and down between near 0 and 270ms. That doesn't make sense to me -- first I don't see how some of them would have an RTT time of near 0 -- I don't see how that would be possible, so I figure I don't understand how to read the graph. Also, I don't see why the RTT would jump up and down and why there are "gaps" in the graph like between 45-85 seconds, vs. almost a solid-like appearance between 380-410s. Here is the RTT and througput graphs I'm trying to decipher: https://i.imgur.com/4ijLxTJ.jpg It looks like I have a relatively low latency when the graph peaks at around 150ms, but then something causes a jump so that latency climbs to over 250ms. It also seems to be the case where I'm getting low latency that my throughput peaks with average packet length falling from 1500 down to <100bytes. I don't see any clear errors. or why there is such a sudden drop Should I be looking for some type of dropped packets or errors? Could this be cause by my ISP cutting bandwidth in a step-wise manner as a means to control? Or could this be some sort of buffer-bloat with some buffer filling up and something halting output to wait for some buffers to drain...?? Another possibility is the application on my end is running on a high speed internal net with a 9k jumbo frame size -- could the mismatch between that the external frame size of 1.5k be causing some type of hysteresis? Any ideas on how, if it is possible I might even this out? It sorta wreaks havok with the local application... Thanks! ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-users] (Is this message being received by anyone?) How to interpret RTT graph
On 3/28/2019 7:35 AM, L A Walsh wrote: > (Sorry for duplicates if there are any) > Usually I see a copy of my email come back to me when I send > an email to a list, but have seen nothing back from the list. > I verified my list options, and it seems there might be one > that could cause suppression depending on definitions, so I > toggled it to see if that makes a difference. > --- It seems that made a difference (assuming any prior copies got through!) Sorry for extra noise, but still have Question about interpreting the RTT graph... Thanks! -l ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-users] (Is this message being received by anyone?) How to interpret RTT graph
I received it! I think most people have moved to an online forum-I forget the details, but perhaps someone else can chime in with them for us? Thanks! :) > On Mar 28, 2019, at 10:35 AM, L A Walsh wrote: > > (Sorry for duplicates if there are any) > Usually I see a copy of my email come back to me when I send > an email to a list, but have seen nothing back from the list. > I verified my list options, and it seems there might be one > that could cause suppression depending on definintions, so I > toggled it to see if that makes a difference. > > Thank-you for your forbearance. > > > I was looking to understand the Round Trip Time graph and why it > > seems to jump up and down between near 0 and 270ms. That doesn't make > sense to me -- first I don't see how some of them would have an > RTT time of near 0 -- I don't see how that would be possible, so > I figure I don't understand how to read the graph. > > Also, I don't see why the RTT would jump up and down and why there > are "gaps" in the graph like between 45-85 seconds, vs. almost a > solid-like appearance between 380-410s. > Here is the RTT and througput graphs I'm trying to decipher: > > https://i.imgur.com/4ijLxTJ.jpg > > It looks like I have a relatively low latency when the graph > peaks at around 150ms, but then something causes a jump so that > latency climbs to over 250ms. > > It also seems to be the case where I'm getting low latency that > my throughput peaks with average packet length falling from 1500 > down to <100bytes. > > I don't see any clear errors. or why there is such a sudden drop > > Should I be looking for some type of dropped packets or errors? > > Could this be cause by my ISP cutting bandwidth in a step-wise > manner as a means to control? Or could this be some sort of > buffer-bloat with some buffer filling up and something halting > output to wait for some buffers to drain...?? > > Another possibility is the application on my end is running on a > high speed internal net with a 9k jumbo frame size -- could the > mismatch between that the external frame size of 1.5k be causing > some type of hysteresis? > > Any ideas on how, if it is possible I might even this out? > > It sorta wreaks havok with the local application... > > Thanks! > > > > > ___ > Sent via:Wireshark-users mailing list > Archives:https://www.wireshark.org/lists/wireshark-users > Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users > mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-users] (Is this message being received by anyone?) How to interpret RTT graph
On Mar 28, 2019, at 11:58 AM, Shawn Carroll via Wireshark-users wrote: > I received it! I think most people have moved to an online forum-I forget the > details, but perhaps someone else can chime in with them for us? Thanks! :) I'm unaware of any online forum for Wireshark. Wireshark *does* have a question-and-answer site, but that's not a forum - a Q site is a crowdsourced FAQ, where the goal is to *avoid* discussion as much as possible by making it possible for people to find questions that have already been asked and answered, so they just have to read the answer, rather than post a question and wait for the answer. That's why, for example: when an unrelated question is asked in a comment, we say it should be asked separately (with the old Q software, we could turn it *into* a question, and did); we edit unclear question titles to make it clearer what's being asked. ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-users] (Is this message being received by anyone?) How to interpret RTT graph
On Mar 28, 2019, at 12:37 PM, Guy Harris wrote: > Wireshark *does* have a question-and-answer site, but that's not a forum - a > Q site is a crowdsourced FAQ, where the goal is to *avoid* discussion as > much as possible by making it possible for people to find questions that have > already been asked and answered, so they just have to read the answer, rather > than post a question and wait for the answer. That's why, for example: ... if a question is asked in a comment on the original question, in order, for example, to get more information required to answer the question but not present in the original question, the answer to that question should be posted as a subsequent comment to the original question, *NOT* as an answer to the original question, and why we'll change an "answer" that doesn't answer the original question into a comment - an answer, on a Q site, should be an answer to the original question; if a question is asked in a comment on an answer, in order, for example, to get details of the answer explained better, the answer to that question should be posted as a subsequent comment on that answer. Note also that you can edit your own question, so that, if a comment is posted asking for more details, you can put the details in your question - just post a comment saying you've updated the question. That way, the original question can be read by others, to see whether it's the same question as the one to which they're looking for an answer. ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
[Wireshark-users] How to interpret RTT graph
I was looking to understand the Round Trip Time graph and why it seems to jump up and down between near 0 and 270ms. That doesn't make sense to me -- first I don't see how some of them would have an RTT time of near 0 -- I don't see how that would be possible, so I figure I don't understand how to read the graph. Also, I don't see why the RTT would jump up and down and why there are "gaps" in the graph like between 45-85 seconds, vs. almost a solid-like appearance between 380-410s. Here is the RTT and througput graphs I'm trying to decipher: https://i.imgur.com/4ijLxTJ.jpg It looks like I have a relatively low latency when the graph peaks at around 150ms, but then something causes a jump so that latency climbs to over 250ms. It also seems to be the case where I'm getting low latency that my throughput peaks with average packet length falling from 1500 down to <100bytes. I don't see any clear errors. or why there is such a sudden drop Should I be looking for some type of dropped packets or errors? Could this be cause by my ISP cutting bandwidth in a step-wise manner as a means to control? Or could this be some sort of buffer-bloat with some buffer filling up and something halting output to wait for some buffers to drain...?? Another possibility is the application on my end is running on a high speed internal net with a 9k jumbo frame size -- could the mismatch between that the external frame size of 1.5k be causing some type of hysteresis? Any ideas on how, if it is possible I might even this out? It sorta wreaks havok with the local application... Thanks! ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-users] (Is this message being received by anyone?) How to interpret RTT graph
On Thu, Mar 28, 2019 at 10:45 AM L A Walsh wrote: > On 3/28/2019 7:35 AM, L A Walsh wrote: > > (Sorry for duplicates if there are any) > > Usually I see a copy of my email come back to me when I send > > an email to a list, but have seen nothing back from the list. > > I verified my list options, and it seems there might be one > > that could cause suppression depending on definitions, so I > > toggled it to see if that makes a difference. > > > --- > It seems that made a difference (assuming any prior > copies got through!) > > Sorry for extra noise, but still have Question about > interpreting the RTT graph... > When in doubt you can always check the archives: https://www.wireshark.org/lists/wireshark-users/201903/ One person did reply to your email - not sure if you saw it. ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
[Wireshark-users] How to interpret RTT graph
I was looking to understand the Round Trip Time graph and why it seems to jump up and down between near 0 and 270ms. That doesn't make sense to me -- first I don't see how some of them would have an RTT time of near 0 -- I don't see how that would be possible, so I figure I don't understand how to read the graph. Also, I don't see why the RTT would jump up and down and why there are "gaps" in the graph like between 45-85 seconds, vs. almost a solid-like appearance between 380-410s. Here is the RTT and througput graphs I'm trying to decipher: https://i.imgur.com/4ijLxTJ.jpg It looks like I have a relatively low latency when the graph peaks at around 150ms, but then something causes a jump so that latency climbs to over 250ms. It also seems to be the case where I'm getting low latency that my throughput peaks with average packet length falling from 1500 down to <100bytes. I don't see any clear errors. or why there is such a sudden drop Should I be looking for some type of dropped packets or errors? Could this be cause by my ISP cutting bandwidth in a step-wise manner as a means to control? Or could this be some sort of buffer-bloat with some buffer filling up and something halting output to wait for some buffers to drain...?? Another possibility is the application on my end is running on a high speed internal net with a 9k jumbo frame size -- could the mismatch between that the external frame size of 1.5k be causing some type of hysteresis? Any ideas on how, if it is possible I might even this out? It sorta wreaks havok with the local application... Thanks! ___ Sent via:Wireshark-users mailing list Archives:https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
