This recipe explains how Wireshark can be used to troubleshoot networking bottleneck issues. The working mechanism may vary depending on the type of traffic in the network. Ideally, the flow is a combination of different protocols. For example, a client that is trying to establish a session with the application server will use a name resolution protocol such as DNS to identify the IP address of the end server.

Once the IP address is received, it may send TCP SYN to establish a TCP session if the transport protocol is TCP (for example, HTTP or FTP). If the transport protocol for the application is UDP (for example, QUIC), it will simply send the application request over UDP packets. The server, upon receiving the request, will pump the data over the network towards the client.

Any network devices (L2 switches and routers) will forward the traffic over the best path. Depending on the availability of equal cost paths, the router may load balance different flows over different paths.

There are different factors that come into the picture for end-to-end performance. End application server processing capability and memory play a key role in session handling and data transfer. Network capacity planning plays a key role in end-to-end data transfer between different clients and servers.