wireshark packet capture point

Question

I am using tc qdisc to add delay to packets on my interface eth2 as follows

sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25%

Then I pinged a host and got some result. The results on the terminal showed that the RTT was 74 ms while the RTT that I calculated from the Wireshark time stamp is around 64 ms.

What this suggests me is that Wireshark shows us the packets as soon as from the libpcap. libpcap sits right after the NIC and all the netem delays are added only after libpcap has seen the packet. As for the terminal result, the ping program sees the packet after the netem delay and thus after 100 more ms.

Is there any way I can use Wireshark to see the packets on the application layer or after the netem delay.

If Wireshark cannot do that, can someone suggest me other options? I know I can use another Linux box, outside of my box under test and delay it on the outer box. But I would prefer to avoid using an extra Linux box.

Answer 1

Wireshark must listen on an interface and cannot see packets at the application layer.

If you really need a tool like Wireshark, you may ping from a VM or a container and (on the host) have Wireshark listen on the virtual interface or the bridge that connects that VM to the physical interface. You can also just set up a veth pair if you want to avoid the burden of creating a VM.

But if all that interests you is the timings, strace may be enough with your current configuration:

# strace -r -T -e network ping 1.2.3.4
...
0.000113 sendmsg(...) = 64 <0.000032>
0.000055 recvmsg(...) = 84 <0.101680>
64 bytes from 1.2.3.4: icmp_seq=1 ttl=64 time=101 ms
...

Between angle brackets is the time spent during the system call. Since the sendmsg is immediate (the bytes go directly to the lower networking layers), the time that follows recvmsg shows (roughly) the time it took to actually send and receive the ping messages, i.e. the RTT.