Thread Links | Date Links | ||||
---|---|---|---|---|---|
Thread Prev | Thread Next | Thread Index | Date Prev | Date Next | Date Index |
These are the stats frame size As far as I know, Wireshark does some reassembly and this might be skewing the frame sizes. I will disable it next time when exporting frame information However, I may need to go into the laptop I am using for capture purposes and disable NIC offload. That seems to affect the captured packet sizes whereby multiple frames may be lumped together when handed off to the OS layer. I will perform the necessary changes when I get back home today and run the capture overnight again. As far as timestamps are concerned, based on documentation of libcap, tshark / wireshark use start of packet as a reference point. Marek From: Glen Kramer <glen.kramer@xxxxxxxxxxxx> Marek, This is great. It is interesting that upstream is only 3% of the total frame count. Can you check in your setup what is reported as packet length? There are about 1.6K packets with the length between 60 and 63 bytes. On the large side, there are 180 packets with sizes above jumbo frame, from 11270 to the largest 32123 bytes. Are these IP packet lengths? Do you have L2 frame lengths in the pcap? To find out the interval *between* frames, frame lengths are needed in addition to timestamps. Also, I don’t remember what is the captured timestamp in wireshark – is this the beginning of a packet or the end after FCS is checked? Do you know? Thanks, Glen From: mxhajduczenia@xxxxxxxxx <mxhajduczenia@xxxxxxxxx> Glen, Here is the result for last night (9pm – 7am) with 1 second interval. Local time is used for reference. I sanitized the data and it is available in Excel format for offline analysis: https://drive.google.com/file/d/1lyi2UPZh7xcqdUJyul-mYRX3YV2An9FB/view?usp=sharing. The file is too big to share directly via email so I am sharing it via GDrive. I have the raw pcap file as well, should it be needed. The capture was done at the input interface into my edge firewall, so it contains all Internet traffic before anything gets filtered. Marek From: Glen Kramer <glen.kramer@xxxxxxxxxxxx> Marek, IOT or not is not so important. What is interesting is what the traffic looks like when nobody is actively using the Internet, like in the middle of the night. (Sent from Samsung Galaxy far, far away, where typos are normal) On Tue, Jul 27, 2021, 6:04 PM Marek Hajduczenia <mxhajduczenia@xxxxxxxxx> wrote:
To unsubscribe from the STDS-1904-4-TF list, click the following link: https://listserv.ieee.org/cgi-bin/wa?SUBED1=STDS-1904-4-TF&A=1 |