Wireshark-users: Re: [Wireshark-users] IO Graph Load(*)
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Wed, 4 Mar 2009 10:34:43 +1100


On Wed, Mar 4, 2009 at 10:01 AM, Bland Chuck-CNGR85 <Chuck.Bland@xxxxxxxxxxxx> wrote:
"You use on "response time" fields,   like rpc.time   for NFS."
[Chuck] How can I tell which ones are response times? This name doesn't give an indication. The same goes for many other time variables.


There is no canonical list of filter field names.

The easiest (only?) way to find a "response time" field is to load a capture file,
select a response packet for the protocol you are interested in and see if there is any synthetic (wrapped inside [ ] ) fields
named "time since request" or similar that represents the response time.
Clicking on that field to select it will show you the filter name in the text blurb box at the lower left of the wireshark window.



For the more popular NAS/SAN protocols these would be

smb.time / smb2.time for CIFS
rpc.time  for NFS (and all other onc-rpc based protocols)
scsi.time   for SCSI
iscsi.time   for iSCSI
fc.time  for fibre channel


But there are a lot of other protocols that measure response times as well.
What set of protocols are you primarily interested in ?


ronnie s