Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can you recommend me to do that?

share|improve this question

1 Answer 1

Justniffer is what you are looking for:

 +---------+                           +---------+

 |         |                           |         |

 |  Client |                           | Server  |

 |         |                           |         |

 +---------+                           +---------+

      |                                     |

      |  -----   connect syn   -------->    |----+

      |                                     |    |

      |  <------   syn/ack    --------->    |    | %connection.time

      |                                     |    |

      |  -------     ack     ---------->    |    |

      |           ESTABLISHED               |----+

      |                                     |    | %idle.time.0 

      |                                     |    |(after connection, before 

      |                                     |    | request)

      |                                     |    |

      |  ---  request/first packet  --->    |----+

      |  <------     ack     -----------    |    |

      |                                     |    |

      |  ---  request/....          --->    |    | %request.time

      |  <------     ack     -----------    |    |

      |                                     |    |

      |  ---   request/last packet  --->    |    |

      |  <------     ack     -----------    |----+--------------------+

      |                                     |    |                    |

      |                                     |    |                    |

      |                                     |    |%response.time.begin |   

      |                                     |    |                    |

      |  <--  response/first packet ----    |----+                    | response 

      |  -------     ack     ---------->    |    |                    | time

      |                                     |    |                    |

      |  <--  response/....         ----    |    |%response.time.end   |

      |  -------     ack     ---------->    |    |                    |

      |                                     |    |                    |

      |  <--  response/last packet  ----    |    |                    |

      |  -------     ack     ---------->    |----+--------------------+

      |                                     |    |

      |                                     |    |

      |                                     |    | %idle.time.1 (after response, 

      |                                     |    | before new request or close)

      |                                     |    |

      |  <------   close      --------->    |----+

      |                                     |    |

      |                                     |    |

To get server response time, you can use:

$ justniffer -l "%connection.timestamp(%F %T)%tab \
%source.ip:%source.port%tab \
%dest.ip:%dest.port%tab \
%response.time%tab \
%request.header.host%tab \
%request.url" -f admarket.pcap | sort -t$'\t' -k5,5 -k 4,4rn | head

2011-07-12 09:49:31  src:57351   dst:80  0.032874    domain.com  /home/estimate/?locat=&city=51
2011-07-12 09:49:25  src:34304   dst:80  0.012820    domain.com  /login
2011-07-12 09:49:25  src:38284   dst:80  0.007185    domain.com  /js/custom.js
2011-07-12 09:49:25  src:38320   dst:80  0.006726    domain.com  /js/swfobject.js
2011-07-12 09:49:25  src:38330   dst:80  0.006291    domain.com  /js/jquery.pngFix.pack.js
2011-07-12 09:49:25  src:38374   dst:80  0.004441    domain.com  /js/datepicker_v2.js
2011-07-12 09:49:25  src:38298   dst:80  0.004249    domain.com  /js/jquery.caret.1.02.js
2011-07-12 09:49:25  src:38742   dst:80  0.002814    domain.com  /js/jquery.tablesorter.js
2011-07-12 09:49:25  src:42555   dst:80  0.002737    domain.com  /images/quang_cao_baomoi.jpg
2011-07-12 09:49:25  src:38293   dst:80  0.002591    domain.com  /js/jquery.meio.mask.js
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.