Using Wireshark for Network Performance Analysis

Introduction

Wireshark is not just for troubleshooting network issues; it's also an excellent tool for analyzing and optimizing network performance. This guide will walk you through using Wireshark to identify performance bottlenecks, analyze traffic patterns, and make data-driven decisions to improve your network's efficiency.

Pro Tip: For accurate performance analysis, ensure you're capturing packets as close to the source of the issue as possible. This might mean setting up packet captures on multiple network segments.

Key Performance Indicators (KPIs)

When analyzing network performance with Wireshark, focus on these KPIs:

Latency: Time taken for packets to travel from source to destination
Throughput: Amount of data transferred over a period of time
Packet Loss: Percentage of packets that fail to reach their destination
Retransmissions: Frequency of TCP packets being resent
Application Response Time: Time taken for applications to respond to requests

Analyzing Latency

1. Using the Round-Trip Time (RTT) Graph

Go to Statistics > TCP Stream Graph > Round Trip Time Graph
Select a TCP stream to analyze
Look for spikes or consistently high RTT values

2. Calculating Time Delta

To measure time between specific events:

Select the first packet
Ctrl-click (or Cmd-click on Mac) the second packet
Look at the "Time delta from selected packet" in the packet details pane

Tip: Use display filters like tcp.analysis.ack_rtt > 0.1 to highlight packets with high RTT.

Measuring Throughput

1. Using the I/O Graph

Go to Statistics > I/O Graph
Configure the graph to show bits per second (Y Axis Unit: Bits/s)
Add multiple graphs to compare different types of traffic

2. Conversation Statistics

To see throughput between specific hosts:

Go to Statistics > Conversations
Sort by "Bytes" column to see highest data transfer conversations

Detecting Packet Loss

1. Using Expert Information

Go to Analyze > Expert Information
Look for "Severity: Warning" entries related to retransmissions or duplicate ACKs

2. TCP Lost Segment Counter

Use this display filter to show potentially lost segments:

tcp.analysis.lost_segment

Note: Not all retransmissions indicate packet loss. Some might be due to network congestion or other factors.

Analyzing Retransmissions

1. Using Display Filters

To show only retransmitted packets:

tcp.analysis.retransmission

2. TCP Stream Graphs

Go to Statistics > TCP Stream Graph > Time Sequence (tcptrace)
Look for vertical lines indicating retransmissions

Measuring Application Response Time

1. Using Wireshark's Built-in Tools

For HTTP traffic:

Go to Statistics > HTTP > Request Sequences
Look at the "Time since request" column

2. Custom Analysis

For other protocols, you may need to:

Identify request and response packets
Use the "Time delta from selected packet" feature to measure time between them
Create custom display filters to isolate specific transactions

Advanced Performance Analysis Techniques

Bandwidth Utilization: Use the I/O Graph to compare actual throughput against known link capacity
Protocol Distribution: Analyze Statistics > Protocol Hierarchy to identify unexpected traffic types
TCP Window Size Analysis: Use tcp.analysis.window_full to identify potential bottlenecks
Expert Info Severity: Focus on "Warning" and "Error" entries for quick problem identification

Best Practices for Performance Analysis

Capture traffic during both peak and off-peak hours for comparison
Use capture filters to focus on relevant traffic and avoid overloading your system
Correlate Wireshark data with other monitoring tools for a comprehensive view
Regularly baseline your network performance to easily identify deviations
Document your findings and create custom profiles for quick future analysis