[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	8647
Summary	SUM(tcp.time_delta)tcp.time_delta incorrect
Classification	Unclassified
Product	Wireshark
Version	1.8.6
Hardware	x86
OS	Windows 7
Status	UNCONFIRMED
Severity	Minor
Priority	Low
Component	TShark
Assignee	bugzilla-admin@wireshark.org
Reporter	skendric@fhcrc.org

Build Information:
1.8.6 (SVN Rev 48142) and 1.10.0 RC1
--
I have a trace capturing an SMB file copy between Client and Server.  I'm using
Wireshark to calculate how much time the Client and the Server spent turning
around frames.

Using the GUI, I see an FBAR with an approximate height of 3s when I calculate
how long the Server spent turning around frames:
Filter:  tcp.srcport==445 Calc:SUM(*) tcp.time_delta Style:FBar Tick
interval:1min

And an FBAR with an approximate height of 42s when I calculate how long the
Client spent turning around frames:
Filter:  tcp.dstport==445 Calc:SUM(*) tcp.time_delta Style:FBar Tick
interval:1min

Using tshark, I see a rather different result ... ~44s for /both/ cases.
tshark -nlr server.pcap -o tcp.calculate_timestamp:TRUE -R "(tcp.srcport==445)"
-qz io,stat,600,"SUM(tcp.time_delta)tcp.time_delta"

================================================
| IO Statistics                                |
|                                              |
| Interval size: 44.1 secs (dur)               |
| Col 1: Frames and bytes                      |
|     2: SUM(tcp.time_delta)tcp.time_delta     |
|----------------------------------------------|
|              |1                  |2          |
| Interval     | Frames |   Bytes  |    SUM    |
|----------------------------------------------|
|  0.0 <> 44.1 |  50069 | 50551304 | 44.145992 |
================================================

tshark -nlr server.pcap -o tcp.calculate_timestamp:TRUE -R "(tcp.dstport==445)"
-qz io,stat,600,"SUM(tcp.time_delta)tcp.time_delta"
================================================
| IO Statistics                                |
|                                              |
| Interval size: 44.1 secs (dur)               |
| Col 1: Frames and bytes                      |
|     2: SUM(tcp.time_delta)tcp.time_delta     |
|----------------------------------------------|
|              |1                  |2          |
| Interval     | Frames |   Bytes  |    SUM    |
|----------------------------------------------|
|  0.0 <> 44.1 |  50069 | 50551304 | 44.145992 |
================================================

I'm willing to believe that 42s ~= 44s in the case of the Client ... but I
believe that the Server-side calculation (srcport==445) is an error.

If you would like more information, do let me know.

--sk

---

      You are receiving this mail because:

• You are watching all bug changes.