Hello, guys, and welcome to the last video for this chapter.
This video, we are going to go and look
into the process of TCP delays and how you can support some network delay usually.
Simply put, us Server our client latent.
So I have fired up Wireshark here and I have loaded recaptured network traffic
that we are going to check for some TCP delays.
What do you might want to focus on while
you are investigating network delays such as Server or client site latency?
Is that which is you might want to use the
due time display format seconds since previous displayed packet.
So you might want to.
For me, it's already selected here, so you might want to go and select that.
So what this shows us is the the time from
the end of the first packet until the time of the end of the next
packet, if you go down here to the transmission control protocol and expand
it here, you might see you will surely see the section stream index.
So now you should know that Wireshark
is numbering all the transactions that is happening in a network.
So what I usually do is that this is a very useful column that you can apply.
So just go ahead on the stream index and.
Go to apply as a column.
So you can see here it appeared it's very
close to info, so let's just go ahead on the column and
align center so we can have some space between the line in the info.
So you can see
the term success would be numbered by Wireshark, if you can see here.
And it's the transaction from one IP
to another IP it's been locked up numbered, as you can see.
So the the difference between the stream
index and the time is that, as I said, the stream index,
like when you are numbering these stream index to these will show us the.
The time of the end of one packet to the time.
So what are the differences between these
three in time and time is that the time measurement here from the end of
one packet to the end of another one, it can be the measurement of two different
transactions so that it can be a little bit longer sometimes.
Although if you focus and you line up by
stream index, you can see that see is the timing of the packet for this stream.
Both are useful. It depends on what you are focusing on.
So if you would like to see in general the delays on the network
and it doesn't matter to which transaction it's happening.
So this is also useful.
But if you would like to focus on a specific transaction that is happening
between, let's say, two IP addresses or between two ports of specific IP
addresses, you might want to focus more on the stream index.
Another useful filter
you can use is if you go here again to TCP transmission control protocol area.
You right click.
You go to control preferences.
Then.
Calculate conversation timestamps.
So unless you press that, you will see that if you will go all the way down,
there is a new section that appeared that it's called timestamp.
So let's expand that and then.
You have here in the drop down menu and
the time since previous frame in TCP stream, so you can go ahead and right.
Click on time since previous frame with this TCP.
In this TCP frame, and you can apply that
as a column to just shorten this out a little bit, right?
Click and align it.
But do we have to say here is that there is some acceptable delays in general,
so let's say, for example, you shouldn't focus on the
huge gap between, let's say, the last receive from the Server for one
client, which means probably the click, the clicked on some link.
And now they're reading an article so that will take a little bit more time for the
user or clients to click on the next link or move some place elsewhere.
So there can be some delays there that you might want to not focus.
So now let's say that I would like to find
the delays that have happened in this network traffic that we captured.
That is more than one second.
So the way to do that is you can go here
times since previous frame in this TCP stream.
So right, click, prepare a filter and select it so you can see that in the
display filter there is a filter named TCP.
time underscore Delta equals equals some number.
So we are going to take advantage of that
and delete this one and the equal equal sign.
And as we said, we would like to see the delay on the network, which is greater.
So we're going to use a greater sign than one second so we can hit enter.
And we can see all the traffic.
That is greater than one second.
Here.
So that was it for the last video of this chapter.
I hope you enjoyed this chapter so far.
And when you're ready, you can go ahead
and click next to move on to the next chapter.
Chapter three, where are you going to
learn how to steal the credentials and files from network streams.