Search code examples
tcpwiresharktcpdumpsniffing

How can I identify the time a TCP packet takes from two nodes?


I need to identify the transfer time of a packet. More specifically I need:

  • The time when the packet leaves node A
  • The time when the packet arrives at node B

Is there any way of identify the packet without error? I was thinking of using tcpdump/tshark at node A and at node B, but is possible to identify the packet?? How?


Solution

  • There's not a unique identification for a TCP packet. There are parameters that combined can help you to recognize a packet, but there's not a 100% guarantee that won't repeat (specially when analizing huge quantity of packets). Those parameters are:

    • src ip
    • dst ip
    • src port
    • dst port
    • ip id

    When a TCP connection is stablised, the TCP identification numbers wraps after sending only 65536 packets, so I'll choose to analyze packets before wrapping.

    I got that info from: https://www.wireshark.org/lists/wireshark-users/201004/msg00216.html