Side-by-side, the Stevens and trace graphs look similar at first glance. However, taking the time to learn about the more advanced TCP trace graph is worthwhile to ee the symptoms and the causes of a bad connection. Using the Stevens graph, you can troubleshoot the performance of a TCP connection.

This is a typical case of a download without bidirectional data transmission. The sequence number does not increase at all. The IP address 192.168.1.178 barely transmits any data. In the example, we see a reasonably stable data transfer from 131.188.12.211 to 192.168.1.178.īy switching the direction of the TCP graph using the Switch Direction button at the bottom right of the TCP graph window, you can examine the transmitted data in the reverse direction ( 192.168.1.178 to 131.188.12.211). Since numbers count bytes sent or transmitted, sequence numbers plotted over time show a connection's throughput (data per second) in one direction. The unit of the y-axis is sequence numbers, hence the name time-sequence diagram. The x-axis is the relative time since the beginning of the connection in seconds. The graph's direction is in the upper part of the window.

Click Statistics, TCP Stream Graphs, and TCP Graph (Stevens).Ī new window opens with the Stevens TCP graph. Next, open one of the TCP diagrams and plot the connection. Selecting any packet in the packet list is sufficient. To open a graph, you must select a packet belonging** to the relevant connection in the packet list. TCP Graphs BasicsĪll TCP graphs, whether Stevens or the trace flavor, represent one TCP connection in one direction. In this PacketSafari article, we will start from the basics, work our way to more advanced concepts, and provide clear patterns to look for when troubleshooting a TCP connection. There are two versions of the time sequence graph, the more straightforward Stevens graph** and the more advanced TCP trace graph. This article will teach you how to interpret TCP connections using the TCP time-sequence graphs. Wireshark offers a couple of graphs for TCP analysis: RTT, throughput, window scaling, and the time sequence graphs. Having a basic understanding of how Wireshark visualizes packet information in a TCP graph, you can take shortcuts in the analysis workflow and avoid spending many hours looking for patterns that are barely visible in the limited perspective of the packet list. Why don't you use graphs instead? They are a powerful tool in a packet analyst's craft.

Wireshark graph analysis