Wireshark-users: [Wireshark-users] VNC playback
From: Jonathan Polacheck <jonpol@xxxxxxxxxxxxx>
Date: Tue, 01 May 2007 14:05:58 -0500
Hello all,

I need to correlate "user experience" with trace data. For instance, we use an ASP that sends data over TDS to a custom client over dedicated bandwidth. I get all kinds of "performance" complaints. At least once the fix was a Central Office that our MPLS provider works with. Other fixes were at the desktops and others were at the ASP.

But I often have to analyse traces on applications I have no personal experience with and mediate between the end users who are reporting the problem and the developers (both internal and external) that might actually have a clue as to what the traffic I see is doing (or not doing).

Having a record of the desktop that generated the client side traffic would be a great help in both understanding the problem and getting the developer pointed in the right direction.

I have looked at some screen capture packages, but they are clumsy to use and place too much overhead on the desktop (cpu, ram and disk). I have used VNC and watched myself, but a playback would be much more effective.

There are some open-source efforts to get VNC playback, but so far I have been unable to get any of them to work. How cool would it be to be able to playback VNC data right from the trace that has the client/server traffic? And frame numbers to show the exact correlation between traffic and desktop events!?

Wireshark does VOIP playback now. rfbproxy does VNC playback from it's own file format. It seems like all the pieces are available.

I think this could be a quantum leap in my ability to both document and diagnose end user issues. What do you think?