I wonder if anyone could provide some information about how Wireshark
calculates the TCP round trip time (e.g. for the tcp stream graphs)?
If a packet contains payload, and thus is acked, I can see how you can
time the outgoing packet and it's ack and give a round trip time by the
difference between them. I'm assuming this is how wireshark does it.
If a packet does not contain payload there will be no ack that can be
directly associated with it, and so the above won't work. A quick look
at the source suggests it might just give the time between acks as the
round trip time in this case. Is that right or does wireshark do
something more clever?
Many thanks
Kieran