Wireshark-dev: Re: [Wireshark-dev] Transmission Latency Calculation

From: Ed Beroset <beroset@xxxxxxxxxxxxxx>
Date: Mon, 01 Oct 2012 09:09:55 -0400
Christopher Maynard wrote:
Herb Falk <herb@...> <Herb@...> writes:

I am creating a dissector that needs to be able to calculate the transmission
latency of a packet.

The protocol being dissected has the timestamp of the “transmission”, I need
to be able to gain access to the time of capture of wireshark in order to
calculate the difference.  Anybody know an example/documentation pointer?

I haven't done that exactly, but have used the tcp ACK round trip time to get some indication of latency. I then used the statistical package R to do further analysis. To get that information into text format for the analysis, I used tshark:

tshark -r sample.pcap -Tfields -eframe.number -eip.src -etcp.srcport -eip.dst -etcp.dstport -etcp.analysis.ack_rtt > rtt.txt

I believe pinfo->fd->abs_ts has what you're looking for.  But you'll need the
clocks of the transmitting and capturing devices to be synchronized in order to
obtain any meaningful latency calculations.

That's true. A possibly useful discussion on this issue (with relevance particularly to NTP) is here: http://www.eecis.udel.edu/~mills/stamp.html

Ed