1

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it's communication with the server for a given application routine.

Setup: The desktop app runs in Windows Server VirtualBox VM. The capture is done on that VM on the Ethernet interface. The app server is running on the Mac side and bound to the vboxnet0 interface to talk to the VM.

Why: I am trying to learn more about processing load, traffic estimation and things like that to learn how to scale a system.

This is one of the GET requests the app makes to bring a JSON back. The length field is 1242B. enter image description here

From what I understand form other posts and documentation length is the size of the frame that was captured. Hence, a unit of data for every layer above should be smaller. So the TCP segment size is 1188B, which makes sense.

What I don't understand is how this frame size of 1142B is related to reassembled TCP segments size of 76448B? If I look at how Wireshark display is I see that this 1142B frame has #1387. If I click on that highlighted row (see pic above) and then go to "Reassembled TCP" section I see that there are 54 frames and the last frame is #1387, which is the one displayed.

So Question 1: does this actually mean that there are in fact 54 more frames that are intentionally hidden from the capture output and sort of folded into that one line from the above picture?

enter image description here

Question 2 I am struggling to better put this into a question, so I will try to elaborate what I don't understand. Length is number of bytes captured in a particular frame. However, it's clear that there are more than one frame that make up the highlighted message in the first picture because reassembled TCP is 76448B and the JSON message in it is too large to fit into 1242B. So if the length field can't be used to get the size of the message, what is the right procedure to get that?

In other words, how can one use Wireshark to estimate the amount of data sent between two nodes?

And if Wireshark it not the right tool for this, what is?

closed as too broad by Ron Maupin Jul 24 '18 at 0:14

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Can you post the capture file to cloudshark so we can analyze it further? – Ron Trunk Apr 14 '17 at 1:26
  • @RonTrunk I thought about it, but the dump I was looking at has some sensitive data. I will be able to post another one once I get back to my work computer and change the data. Thank you for the recommendation however. – Serge Poele Apr 16 '17 at 23:58