0

I'm using iperf3 to send 1005 TCP packets with the commands:

iperf3 -s -i 1 -f m -p 5200 -D

iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200

In server, client respectively.

The output from the client command is:

Connecting to host 10.60.0.113, port 5200 Reverse mode, remote host
10.60.0.113 is sending [  5] local 10.60.0.2 port 33929 connected to 10.60.0.113 port 5200 protocol: TCP  num_streams: 1  blksize: 131072  omit: 2  duration: 0  bytes

[ ID] Interval           Transfer     Bitrate 
[  5]   0.00-1.00   sec 64.4 MBytes   540 Mbits/sec                  (omitted) 
[  5]   1.00-2.00   sec  73.1 MBytes   613 Mbits/sec                  (omitted)

 iperf test finished. [  5]   0.00-0.40   sec  28.7 MBytes   607 Mbits/sec                  
- - - - - - - - - - - - - - - - - - - - - - - - - 
[ ID] Interval           Transfer     Bitrate         Retr 
[  5]   0.00-0.40   sec  32.5 MBytes 688 Mbits/sec    0             sender 
[  5]   0.00-0.40   sec  28.7 MBytes   607 Mbits/sec                  receiver

iperf Done.

I start capturing with tshark a bit earlier than I run the iperf commands and finish a bit later, but I'm using the capture filter:

host 10.60.0.2 and tcp

In the pcap file there are 24418 packets. These are the complete statistics of the capture:

First Packet Time: 20-06-20 02:42:23 Last Packet Time: 20-06-20 02:42:25 Elapsed: 00:00:02

Packets: 24418 Between first and last: 2575.64 ms Avg. packets per sec: 9480.37 Avg. packet size: 7428 Bytes: 181382938 bytes Avg bytes per sec: 70422499.94

I also run this one in the client:

tcpdump -i 2 src 10.60.0.113

and get 1300 approximately packets

I don't really understand the relation between the traffic sent and the traffic captured. I hope you guys can guide me a bit! :)

0

1 Answer 1

1

When you set your capture to "host 10.60.0.2 and tcp" you will get all TCP packets where the host is either the source or the destination.

That means you will also get all the ACK packets sent by the destination host.

Possibly, if you are connected through SSH you will also get all the SSH traffic.

You should filter the taffic to capture more precisely.

Adding "and dst port 5200" or "and src port 5200" depending on where you perform the capture should give better results.

2
  • I'm capturing at the server's ethernet interface, so I guess I need to use the "src port" option, don't I? However, I still get more than 3000 packets. My goal is to compare number of transmitted packets versus number of received packets.
    – Natiya
    Jun 20, 2020 at 17:23
  • I added more info in my question :)
    – Natiya
    Jun 20, 2020 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.