There are a couple of graphs that come in this section. Each of them depicts the network traffic in a graphical form differently. Let's start by taking a look at each one of them.
Round-trip time (RTT) is the duration in which the ACK for a packet that is sent is received, that is, for every packet sent from a host, there is an ACK received (TCP communication), which determines the successful delivery of the packet. The total time that is consumed from the transfer of the packet to the ACK for the same is called round trip time. Follow these steps to create one for yourself:
- Select any TCP packet in your packet list pane.
- Navigate to Statistics | TCP Stream Graph | Round Trip Time Graph.
- The x axis represents the TCP sequence number and the y axis represents the RTT in seconds.
- Each plotted point on the graph represents the RTT of a packet. If you are not seeing anything in your graph, then you might have selected an opposite directional packet.
- RTT graphs are often used by network admins to identify any congestion or latency that can make your network perform slowly.
- To investigate further, just click on any plotted RTT dot in your graph, and Wireshark will point you to that specific packet in the list pane.
The following RTT graph represents normal web traffic, and at some points in the graph, latency can be observed:
Figure 3.14: Round Trip time Graph
Bottleneck and latency can often be identified with a vertical line of plotted RTT dots, which depicts whether the packet from the sending device is first queued up and then sent all at once or whether the packets are suffering with duplicate ACKs or packet loss, where retransmission was required, thus increasing the RTT time.
This graph is very similar to the IO graph that depicts the traffic flow. However, it is different in one important aspect that Throughput graphs depict the unidirectional traffic whereas IO graphs depict the traffic in both directions. For every TCP packet that you select in the list pane, the Throughput graph can be different. If you are seeing a blank graph, then just select another TCP packet and try to create the graph again. Follow these steps to create one for yourself:
- Open the trace file that contains your packets.
- Apply a display filter if required.
- Select any TCP packet from the list pane.
- Navigate to Statistics | TCP Stream graphs | Throughput graph.
- Voila! It's done.
In the title bar, the IP address of the communicating hosts is present, along with the direction of traffic. The x axis represents the time in seconds, and the y axis represents throughput in bytes/seconds. Refer to the following graph (Figure 3.15) that illustrates the same:
Figure 3.15: Throughput Graph
This graph depicts the stream of TCP data over time. The traffic that will be presented is unidirectional (moving in one direction). Time-sequence graph gives us an idea about the segments that are currently traveling, the acknowledgements for segments that we've received, and the buffer area that the client is capable to hold. To create this graph, follow these steps:
- Open the capture/trace file you want to work with.
- Click on any TCP packet from the list pane.
- Navigate to Statistics | TCP Stream Graphs | Time sequence graph(tcptrace).
- You must now see something like the following:
Figure 3.16 : Time Sequence graph (tcptrace)
The x axis of the graph represents the time in seconds and the y axis represents the TCP sequence number. TCP sequence numbers are incremented by the bytes of data sent with every packet, that is, if the sequence number is 1 and the packet we are sending holds 10 bytes of data, then the sequence number will be incremented by 10. Hence, the sequence number for the next packet to be sent will be 11. The throughput of the data is more when we have steeper lines plotted, normally, the graph plotting starts from the lower-left corner to upper-right corner.
There are actually three lines plotted on every graph. The line with multiple I written is the TCP data segment, and the longer the I stream, the more the data in the packet. The line below the TCP segment is the ACK stream for data sent, and the line at the top represents the calculated client-receiving window.
The distance between the client-receiving window line and the TCP segment line is the window size. The closer the line, the less data can be buffered, and vice versa. Consider the following zoomed-in screenshot for more understanding:
Figure 3.17: Throughput graph
Let's suppose that at 1.38 seconds Host A is sending byte 995,000, and at the same time, host A received an ACK for byte 990,000, which states that 5,000 bytes are still unacknowledged (in-flight). A point to be noted here is that the dark grey lines denote the ACKs received.