TRANSUM is a Wireshark plugin that generates detailed response time information to allow network engineers to troubleshoot performance problems with their favorite packet analyzer. TRANSUM is being developed as part of Advance7’s TribeLab project and is its most popular download.
Most modern PCs and servers have powerful network interface chip sets that can provides TCP/IP functionality that cuts the load on the host machine. The most common of these functions is TCP Segmentation Offload (TSO). In this short article we use Wireshark to discover how TSO affects our interpretation of network traces.
A program running in a PC or server may make a single call to the TCP/IP stack to send, say, 5 KB of data. The TCP/IP stack, which is a software driver within the operating system, must repackage the 5 KB so that it can be sent in multiple packets. This operation is called segmentation and it consumes CPU cycles. Additionally, the TCP/IP stack must handle issues such as retransmissions.
A network interface chip set that provides TSO allows the host TCP/IP stack to send a single 5 KB segment. The network interface chip set then re-segments the data into, say, three packets with a TCP Length of 1,460 bytes and one of 798 bytes, making 5 KB in total. This can all appear to be very confusing in a network trace, especially as the packets received may not be aggregated in a similar manner.
In the following short video ...
Not only is TribeLab sponsoring SharkFest this year, they’ll be demonstrating the Workbench product and giving away wearable storage!
On top of all that, they have a session on trace marking techniques. We’ll get the low-down on this week's LMTV.
To help us build our community, please share this live event with your fellow professionals on LinkedIn.
For more episodes of LMTV, please visit LoveMyTool.TV.
For more episodes of "LMTV TribeLab", please visit TribeLab.TV.
In this short series of videos we are looking at troubleshooting a slow response time problem using PCAP traces, Wireshark and markers.
In the last video we discovered a simple way for a user to send a marker into our network traces.
In this video we discover how to find markers in a Wireshark trace. We also ...
In this short series of videos we'll look at troubleshooting a slow response time problem using PCAP traces, Wireshark and markers.
Imagine you work in the network support team at a prestigious university. Users are complaining that the core administration system intermittently hangs.
Perhaps you already have some high capacity network recorders, or you could capture for long periods using dumpcap configured with a ring buffer. The trouble is that the problem is random and the users rarely accurately report the time of the problem. That means that ...