time difference between two packets in wireshark

wireshark pcap libpcap
Ashrip picture Ashrip · Feb 25, 2015 · Viewed 18.8k times · Source

I want to calculate the time difference between the time from sending the packet, to getting its ACK back. I do not see any timestamp related information in the packet, could anyone give me any pointers as to how I can compute the difference.

Answer

Pedro Ferreira picture Pedro Ferreira · Feb 23, 2016

In Wireshark Preferences / Appearance / Columns you can add a new column of type Delta time. With this new column and wise capture filtering you should be able to do what you want.

Related questions

set a filter of packet length in wireshark

I've capture a pcap file and display it on wireshark. I want to analysis those udp packets with 'Length' column equals to 443. On wireshark, I try to found what's the proper filter. udp && length 443 # invalid usage udp &&…

Read More
Easiest way to convert pcap to JSON

I have a bunch of pcap files, created with tcpdump. I would like to store these in a database, for easier querying, indexing etc. I thought mongodb might be a good choice, because storing a packet the way Wireshark/TShark …

Read More
How to filter MAC addresses using tcpdump?

I am running tcpdump on DD-WRT routers in order to capture uplink data from mobile phones. I would like to listen only to some mac addresses. To do this I tried to run the command using a syntax similar to …

Read More