Wireshark · Wireshark-users: [Wireshark-users] question on dcerpc

[garrett.allen@xxxxxxxxxxx]

folks,

 

i've scanned the archives and asked mr. google, but no joy.

 

background

running a lab simulation between an exchange server and a symantec server (physical servers connected via gig-e through a switch).  dcerpc is the protocol they are using.  on the symantec server we introduce wan latency simulation using another package.  when displaying the round trip time diagram we see latency that is twice what we configured when we highlight one packet of the conversation and when we highlight another and regraph it shows the proper rtt.   same source / dest ip's, both are dcerpc requests.  we also ran an ftp copy between the two boxes and graphing it shows the proper rtt of 60ms total. 

 

question

how is round trip time graph calculated for dcerpc in wireshark?

 

any info/help appreciated.

 

thanks.