I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it's communication with the server for a given application routine.
Setup: The desktop app runs in Windows Server VirtualBox VM. The capture is done on that VM on the Ethernet interface. The app server is running on the Mac side and bound to the vboxnet0 interface to talk to the VM.
Why: I am trying to learn more about processing load, traffic estimation and things like that to learn how to scale a system.
From what I understand form other posts and documentation length is the size of the frame that was captured. Hence, a unit of data for every layer above should be smaller. So the TCP segment size is 1188B, which makes sense.
What I don't understand is how this frame size of 1142B is related to reassembled TCP segments size of 76448B? If I look at how Wireshark display is I see that this 1142B frame has #1387. If I click on that highlighted row (see pic above) and then go to "Reassembled TCP" section I see that there are 54 frames and the last frame is #1387, which is the one displayed.
So Question 1: does this actually mean that there are in fact 54 more frames that are intentionally hidden from the capture output and sort of folded into that one line from the above picture?
Question 2 I am struggling to better put this into a question, so I will try to elaborate what I don't understand. Length is number of bytes captured in a particular frame. However, it's clear that there are more than one frame that make up the highlighted message in the first picture because reassembled TCP is 76448B and the JSON message in it is too large to fit into 1242B. So if the length field can't be used to get the size of the message, what is the right procedure to get that?
In other words, how can one use Wireshark to estimate the amount of data sent between two nodes?
And if Wireshark it not the right tool for this, what is?