RTT timing for TCP packet using Wireshark

Question

I want to calculate the Round Trip timing for the TCP packets.

But in wireshark, I don't see any particular field for the RTT timing for a TCP packet like its there for the RTP packet.

Wireshark do calculates the RTT graph but i am not finding as how it has been calculated.

Can someone help me out in finding the formula used for the same?

Prerogative

Timing is implicit in TCP (RTP, as its name suggests, relates explicitly to timing). RTT is calculated by Wireshark on packets that have ACKs of past segments, and is calculated as the time delta between the original packet's SEQ and this packet's ACK. Since it is calculated, you will see it under [SEQ/ACK analysis] of the packet and not as a field. – Variegate

Answer 1

There is nothing inside TCP that gives the round-trip time. It's estimated by the kernel based on how long it takes to receive an ACK to data that was sent. It records the timestamp of when a given sequence number went out and compares it to the timestamp of the corresponding ACK. The initial 3-way handshake gives a decent starting value for this.

However, this is only an estimate as the receiver is free to delay ACKs for a short period if it feels it can respond to multiple incoming packets with a single reply.

RTT frequently changes over the duration of the session due to changing network conditions. The effect is (obviously) more pronounced the further away the endpoints.

Sticky

Answer 2

If you want to get the values of the RTT calculated by wireshark/tshark, the following did the trick for me to print them on stdout:

tshark -r myfile.pcap -Y 'ip.addr == AA.BB.CC.DD' -T fields -e tcp.analysis.ack_rtt

(where I used the display filter after -Y to restrict the analysis to only one remote host)

Blaney

Answer 3

If you are using wireshark , it show the iRtt =initial Round Trip and the Rtt of each sent packet , just look at "show packet in new window /seq/ack analyses "

Caen

Btw, to see iRTT in Wireshark, the latter should capture the tcp connection start (3-way handshake) - since that's when iRTT is calculated. – Insulate