Analysis of Network Performance using Wireshark

Introduction:
The purpose of this report is to perform the analysis on performance of the network by using tool
Wireshark. Wireshark is a tool which is specialized for analysis of network traffic, in starting it was
known as "Ethereal" and then after it is named as Wireshark [1]. This tool is capable to catch the packets
which are sent via network and through this tool performance statistics can be visualized and analyzed
as it gives an interface to user of this tool. Another significant component of this product is that user can
store the data in the files and which can be used later for further analysis [5]. By using Wireshark we can
see all packets which are caught amid the activity and can perform analysis the issue in the network, the
statics which Wireshark provides is used in this report to ascertain the throughput, RTT (for example
Round Trip time) and Retransmission which will help to the comprehend and investigate the
performance of the network.
In the first part of this report we are going to look for the general statistics which Wireshark provide and
analyze those statistic, for example, Time stamp (various sorts of time staff), Total Number of packets
caught amid the session (conversations), Device at which the records are captured and the normal rate
of bytes every second. In Second part the advance analysis is performed on a similar packets which are
caught during the session, the purpose of center will be the throughput and its graphs, TTL and its chart,
Load distribution and proportion of Response and Request and the Errors and Warnings which
Wireshark gives in Expert Info.
In the third part the focus is on comparing the network traffic for both the sites which are given in the
task. In the last part the components of Microsoft message analyzer is contrasted and the Wireshark on
Ease of use, GUI, Visualization and statistics generation.
General Statistics:
Wireshark has number features to get network statistics. This features starts from general statistics
which is “number of packets captured” to “number of HTTP request and responses”.
In statistics of Wireshark, the important feature which exists is “I/O Graphs” which can be used by the
user in order to visualize the traffic and understand about the trend going on.
1) Time of Capture (for website “http://www.lightfm.com.au”):
Following are the options which are provided by Wireshark for time Capture:
 Date and Time of day
 Year, Day of year and Time of day
 Time of day
 Seconds Since
 Seconds since beginning of capture (This is used in the analysis)
Below snapshot shows additional types:

Hence to get the “Time of Capture” we need to navigate to “Time of Day” and select it and then start
the capture of packet.
Snapshot highlights Time of capture:

2) Total Number of Packets: Here it shows that 26000 Packets are captured
(For website “http://www.lightfm.com.au”)
For checking the number of packets there exists two options –
 Option 1 is to go to statistics  Capture file properties (as shown in the below snapshot)
 The second option is to go at the bottom panel of the tool and it has number of packets,
as shown in the below snapshot.

3) IP addresses of the client and server : (for website “http://www.lightfm.com.au”)
So to find the source and destination, Wireshark provides two columns as shown in the
snapshot – “source” and “destination” and both are present for each packet. The user can view
the IP address of the particular packet by clicking on it.
1) Time of Capture (for website “http:// iview.abc.net.au”):
Following are the options which are provided by Wireshark for time Capture:
 Date and Time of day
 Year, Day of year and Time of day
 Time of day
 Seconds Since
 Seconds since beginning of capture (This is used in the analysis)
Below shows additional options available in WireShark:

Hence to get the “Time of Capture” we need to navigate to “Time of Day” and select it and then start
the capture of packet.
2) Total Number of Packets: It shows (58104 Packets)
(For website “http:// iview.abc.net.au”
For checking the number of packets there exists two options –
 Option 1 is to go to statistics  Capture file properties (as shown in the below snapshot)
 The second option is to go at the bottom panel of the tool and it has number of packets,
as shown in the below snapshot.

3) IP Address of Source and Destination: (for website “http:// iview.abc.net.au”)
So to find the source and destination, Wireshark provides two columns as shown in the
snapshot – “source” and “destination” and both are present for each packet. The user can view
the IP address of the particular packet by clicking on it.
Analysis of Network Performance
1. Throughput:
The bandwidth consumed by the website is called throughput, which can be indicated by the
total number of request handled successfully over the transmission time [2]. For checking the
throughput with the help of Wireshark there is an option called “Protocol Hierarchy” under
the statistics tab. With this screen breakdown of bandwidth v/s protocol can be acquired. For
this task we are analyzing HTTP and hence we chose TCP and observe the bytes consumed per
second, which is around 1.05 Mb/sec. For site1 below snapshots indicates the throughput
analysis