0

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can you recommend me to do that?

1 Answer 1

1

Justniffer is what you are looking for:

 +---------+                           +---------+

 |         |                           |         |

 |  Client |                           | Server  |

 |         |                           |         |

 +---------+                           +---------+

      |                                     |

      |  -----   connect syn   -------->    |----+

      |                                     |    |

      |  <------   syn/ack    --------->    |    | %connection.time

      |                                     |    |

      |  -------     ack     ---------->    |    |

      |           ESTABLISHED               |----+

      |                                     |    | %idle.time.0 

      |                                     |    |(after connection, before 

      |                                     |    | request)

      |                                     |    |

      |  ---  request/first packet  --->    |----+

      |  <------     ack     -----------    |    |

      |                                     |    |

      |  ---  request/....          --->    |    | %request.time

      |  <------     ack     -----------    |    |

      |                                     |    |

      |  ---   request/last packet  --->    |    |

      |  <------     ack     -----------    |----+--------------------+

      |                                     |    |                    |

      |                                     |    |                    |

      |                                     |    |%response.time.begin |   

      |                                     |    |                    |

      |  <--  response/first packet ----    |----+                    | response 

      |  -------     ack     ---------->    |    |                    | time

      |                                     |    |                    |

      |  <--  response/....         ----    |    |%response.time.end   |

      |  -------     ack     ---------->    |    |                    |

      |                                     |    |                    |

      |  <--  response/last packet  ----    |    |                    |

      |  -------     ack     ---------->    |----+--------------------+

      |                                     |    |

      |                                     |    |

      |                                     |    | %idle.time.1 (after response, 

      |                                     |    | before new request or close)

      |                                     |    |

      |  <------   close      --------->    |----+

      |                                     |    |

      |                                     |    |

To get server response time, you can use:

$ justniffer -l "%connection.timestamp(%F %T)%tab \
%source.ip:%source.port%tab \
%dest.ip:%dest.port%tab \
%response.time%tab \
%request.header.host%tab \
%request.url" -f admarket.pcap | sort -t$'\t' -k5,5 -k 4,4rn | head

2011-07-12 09:49:31  src:57351   dst:80  0.032874    domain.com  /home/estimate/?locat=&city=51
2011-07-12 09:49:25  src:34304   dst:80  0.012820    domain.com  /login
2011-07-12 09:49:25  src:38284   dst:80  0.007185    domain.com  /js/custom.js
2011-07-12 09:49:25  src:38320   dst:80  0.006726    domain.com  /js/swfobject.js
2011-07-12 09:49:25  src:38330   dst:80  0.006291    domain.com  /js/jquery.pngFix.pack.js
2011-07-12 09:49:25  src:38374   dst:80  0.004441    domain.com  /js/datepicker_v2.js
2011-07-12 09:49:25  src:38298   dst:80  0.004249    domain.com  /js/jquery.caret.1.02.js
2011-07-12 09:49:25  src:38742   dst:80  0.002814    domain.com  /js/jquery.tablesorter.js
2011-07-12 09:49:25  src:42555   dst:80  0.002737    domain.com  /images/quang_cao_baomoi.jpg
2011-07-12 09:49:25  src:38293   dst:80  0.002591    domain.com  /js/jquery.meio.mask.js

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .