Hello all,
Thanks for the replies and sorry for the late reply - in the midst of tons of work and even forgot I started this thread... :(
This is for TCP traffic. In this case I was interested in traffic between a Solaris server and an Oracle database server. The server is continuously communicating with the DB on TCP 1523. The amount of traffic is immense and there has been performance degradation over the past few weeks. So I was in the midst of either eliminating or identifying the network infrastructure as the culprit.
I launched a capture on the server filtering on the DB IP and did the same on the DB except that I filtered on the server IP. Given the amount of data and the fact that this traffic has been ongoing forever there is no TCP SYN that I can match up on.
So, I thought that I could match up TCP sequence numbers across both traces to help me sync up the traces but, based on the Nagle algorithm comment, I guess this is not the case?
Time stamps in these types of traces is tough as well because of the amount of traffic as is the fact that many of these packets are similar in construction and payload.
Is the IP identification field a good way to do this or do I need a different type of tool?
I hesitate to attach capture files to this email as I'm still not up-to-speed on rules & regulations for this forum. I'll be happy to upload them to a different location if possible.
Again, many thanks!
-Samson
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Xilouris George
Sent: Friday, April 24, 2009 4:06 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Simultaneous Captures - Matching Packets
Dear Samson,
On 24 Απρ 2009, at 7:50 ΜΜ, Guy Harris wrote:
>
> On Apr 23, 2009, at 12:10 PM, Samson Martinez wrote:
>
>> Brand-new subscriber to this user-list - long time user of
>> Wireshark. I've been trying to determine the easiest method for
>> matching up packets that have been simultaneously captured on two
>> systems and I thought, it appears erroneously, that all the info in
>> the packets would match, including sequence numbers, etc.
>>
>> For example, I took simultaneous captures on two separate servers
>> (Solaris servers using snoop) and then loaded both files into
>> Wireshark to compare. I used the timestamps & IP Identification
>> field to match up packets. However, the sequence numbers don't
>> match
>> up. Is this normal?
You are refering to TCP or UDP , multicast or unicast ?
Timestamps can only be used if your clocks on both systems are
synchronised accuratelly. TCP sequence numbers are not the same due to
the nagle algorithm.
From what you are trying to do I guess it is a UDP stream that
arrives from the same source to both servers. In this case you have to
use higher level protocol headers in order to manage to match the
packets. i.e if you use MGEN to generate traffic you can use the
timestamp field that is inserted by the generator at source, and
resides on the application protocol header, as a good matching filter.
If you can be more detailed in what you try to do, I may have a better
suggestion.
BR
George
>
> By "sequence numbers" are you referring to TCP sequence numbers, the
> numbers in the "No." column in the display, or some other sequence
> numbers?
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx
> >
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
