When troubleshooting a network problem with Wireshark, it is easy to concentrate on packet addresses, protocols, and conversations while overlooking one of the most useful pieces of information on the screen: time. The Time column can tell you much more than simply when a packet was captured. With the right configuration, it can help reveal delays, gaps in communication, retransmissions, and the sequence of events that led to a problem. If you are trying to understand why an application feels slow or why a TCP conversation is taking longer than expected, packet timing can be a very useful clue.
One of the nice things about Wireshark is that you can change how the Time column represents the packet timestamps. Depending on what you are investigating, you may want to see the actual capture time, time relative to the beginning of the capture, or the amount of time between packets. Changing the time reference can make a confusing capture much easier to understand. For example, when troubleshooting an intermittent problem, looking at the elapsed time between packets can quickly highlight a period where communication stops or becomes unusually slow. Suddenly that giant packet capture starts telling a story instead of looking like a spreadsheet full of numbers.
Timing is especially interesting when you are troubleshooting TCP. TCP relies on timers and acknowledgments to keep communication moving, so delays and retransmissions can provide important clues about what is happening between two endpoints. By adding useful TCP-related information to your Wireshark view and combining it with the Time column, you can start building a timeline of the conversation. Is the server slow to respond? Is the client waiting for data? Are packets being retransmitted? Is there a large gap before an acknowledgment arrives? These are the kinds of questions that packet timing can help answer.
The best way to learn this is to actually work with a capture file rather than simply reading about it. The original video for this post walks through configuring the Wireshark Time column and demonstrates how different time references and TCP timing information can be used during troubleshooting. Download the capture file, open it in Wireshark, and experiment with the Time column yourself. Network troubleshooting is often about finding patterns, and once you get comfortable using packet timing, you will have another valuable way to see those patterns hiding inside a capture.
