Question

Wireshark Question:

4555522222 8 389 2 3 kk325 99111 2 2 7375661 67 .7 7 7 7 9 9 9 9 9 1111115 8 8 8 8 8 8 8 8 8 4 456 9 6 9 99666 08888 kkkkk95 561 8 4688689222222222238242 5 6 476 222222222239 3 6 88715945555555556806 1124 234444444445 4 .1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 2 122 7. 7 7 7 7 5

a. Find the most active TCP conversation in the file (by bits per second).

b. What is the total amount of bytes transferred from A to B and from B to A in the most active TCP conversation? (Hint: right-click on the conversation, select Apply as Filter > Selected > A → B. Save the packets once the filter is applied)

c. Calculate the Round-Trip Time (RTT) between A and B by inspecting the TCP Handshake.

Answer 1

A) If we look at the last two columns, i.e. bits/s A->B and bits/s B->A, we see that the first entry with the IP 141.101.125.193 (rel start 8.655147, duration 0.0554) has the biggest entries in the mentioned columns ( bits/s A->B and bits/s B->A) combined, which are:
108 kbits/s +1250 kbits/s = 1358 kbits/s.

The Rel start and duration values are entered because Address A column was not provided.

Hence it is the most active TCP conversation in the file (by bits per second).
------------------------------------
B) If we consider the most active TCP conversation in the file by bits per second, then the first entry with the IP address 141.101.125.193 (rel start 8.655147, duration 0.0554) is considered. The total amount of bytes transferred from A to B in the following row is 753 bytes and from B to A it is 8649 bytes. Hence a combined total of 9402 bytes.

BUT, If we consider the most active TCP conversation in the file by bytes transferred , then it's the entry with the IP address 207.171.187.117, rel start 32.822986, duration 1.5346. The total amount of bytes transferred from A to B in the following row is 3703 bytes and from B to A it is 122 kbytes. Hence a combined total of 126 kbytes.

-------------------------------------

C) Navigate to the Statistics menu and then go towards TCP Stream Graphs and choose Round Trip Time. After this check the TCP RTT (Round Trip Time) in the bottom table (checklist). The RTT can be found in the TCP header - > SEQ/ACK analysis which measures the time from SYN packet to the ACK packet.