Alexis Kestler
Hi friend! Let‘s dive into using Wireshark for troubleshooting network latency. I‘m excited to share my years of experience as a network analyst to help you pinpoint and resolve lag and delay issues.
Network latency is the bane of any application‘s performance. Just a small amount can disrupt real-time systems. As little as 100-200 ms of latency is perceptible to users, damaging productivity and the experience.
With the ultra-connected world we live in, users expect immediate response times. Latency degrades VoIP calls, video conferencing, online gaming, web browsing, cloud applications, and other network-enabled services.
My friend, by the end of this guide, you‘ll be a Wireshark pro able to hunt down sources of latency even on the most complex networks!
The Need for Speed
Humans are sensitive to short network delays. Research shows that as little as 100 ms of latency leads to:
- Degraded call quality for VoIP and video conferencing
- Lag, rubberbanding, and freezes in online multiplayer games
- Noticeably slower load times accessing web pages and apps
Delays between 100-200 ms are perceptible to users. Beyond 500 ms, the experience deteriorates rapidly:
| 100-200 ms | Human perceivable latency range |
| 200-500 ms | Impaired real-time applications |
| > 500 ms | Unacceptable latency, degraded experience |
Many types of modern applications require low latency for good performance:
- Cloud computing and web applications
- Real-time communications like video conferencing
- Remote desktop and VDI access
- Online gaming and virtual worlds
- Algorithmic trading platforms
- Virtual/augmented reality
- Smart sensors and IoT devices
Wireshark provides millisecond-level visibility into packet transfers, letting us pinpoint excess latency damaging application performance.
Wireshark‘s Super Powers
Wireshark is a network protocol analyzer that captures packet-level traffic. It lets us "listen in" on network communications end-to-end.
Wireshark can see delays caused by any component along the delivery chain, including clients, servers, routers, switches, firewalls, and more.
With Wireshark, we get unique insights into latency like:
- Microsecond-resolution traces for granular troubleshooting
- In-depth TCP metrics like round-trip time (RTT)
- Packet loss and retransmissions highlighted
- Packet defects introducing jitter and delay
- Windowing issues impairing throughput
Commercial tools costing thousands don‘t match the depth of visibility Wireshark provides into networks. It‘s free and open source!
Let‘s look at how Wireshark helps us isolate different root causes of latency. I‘ll share tips from my experience as a network engineer so you can master Wireshark.
Detecting Latency in Captures
Wireshark uses smart color coding to highlight latency issues buried deep in packet traces:
Green indicates normal traffic flow. Orange and red signify delays, retransmissions, and defects:
Green – Smooth TCP communication
Orange – Retransmitted segments
Red – Out-of-order packets
The RTT (round-trip time) graph trends latency over the capture duration, making it easy to spot spikes.
The RTT graph helps identify periods of high latency for further diagnosis.
Let‘s explore some of the top causes of network delays that Wireshark empowers us to isolate and troubleshoot.
Root Cause #1: Bandwidth Bottlenecks
Network pipes can only carry so much traffic. If capacity is exceeded, queues form causing buffering, packet loss, and high latency.
Bottlenecks often occur at:
- Internet/WAN links
- Slow remote office connections
- Over-utilized WiFi networks
- Outdated equipment with slow ports
For one company I worked with, their cloud ERP application slowed to a crawl at the same time each day. In Wireshark, I noticed their WAN circuit maxing out during the issue:
Large data transfers like offsite backups were saturating their WAN link, constraining the ERP‘s performance. Upgrading to a faster WAN circuit resolved the bottleneck.
Always correlate Wireshark latency spikes with link utilization. Compare traffic levels against capacity to identify bottlenecks.
Root Cause #2: High Round-Trip Time
Round-trip time (RTT) quantifies the delay between a packet being sent and its acknowledgment received. High RTT indicates latency somewhere between endpoints.
I once used Wireshark for a financial firm having issues with their algorithmic trading platform. In the RTT graphs, I discovered extremely high latency communicating with their virtualized servers:
The virtual environment used oversubscribed servers causing resource contention and delays processing each trade request. Moving to dedicated hardware resolved their latency.
Always inspect TCP streams in Wireshark and analyze RTT graphs for evidence of high network path latency.
Root Cause #3: Packet Loss
Losing packets breaks the TCP conversation, resulting in costly retransmissions and delays waiting for timeouts.
Packet loss often stems from:
- Network congestion
- Wireless interference
- Faulty NICs or cables
- Errors introduced by network devices
I helped a company troubleshooting video conference quality issues between their offices. In Wireshark, I noticed lots of duplicate ACKs and TCP retransmissions during their calls:
Packet loss was highest traversing their VPN router at one office. Updating its firmware resolved an issue that was dropping packets and impairing voice/video quality.
Packet loss creates major performance issues – always inspect Wireshark traces for evidence of it occurring.
Root Cause #4: TCP Window Scaling
TCP window size controls how much data can be "in flight", impacting transfer speeds and latency.
Small window sizes lead to negative performance impacts:
- Forced serialization waiting for ACKs
- Underutilization of available bandwidth
- Increased round-trip times
- Retransmission of packets in window
I worked with a company to speed up transfers from their on-prem file servers to AWS S3. They had 1Gbps pipes that were performing like a fraction of that.
In Wireshark, I noticed lots of zero window advertisements forcing small window sizes:
Their outdated OS lacked window scaling support. After upgrading, window size increased 4x speeding up transfers.
Analyze window size behavior in Wireshark to identify constraints limiting throughput and introducing latency.
Root Cause #5: Security Controls
Network security tools like firewalls and IPS can add latency due to computational overhead for functions like:
- Deep packet inspection
- Threat intelligence lookups
- Signature and behavior analysis
- SSL/TLS decryption
I worked with a company who upgraded their firewall which immediately slowed applications to a crawl. In Wireshark, I saw significantly higher RTT traversing the new firewall:
Enabling hardware offloading and tuning policies resolved the firewall‘s added latency.
Always inspect latency before and after network security tools to quantify their impact. Optimize configurations to reduce delay.
Resolving Latency – My Recommendations
Here are my tips for improving latency based on years of troubleshooting experience:
For bandwidth bottlenecks:
- Increase link speeds at congestion points
- Implement QoS prioritization for critical traffic
- Load balance across multiple links
- Decrease utilization by pacing transfers during off-peak times
For excessive round-trip times:
- Route around slow WAN/VPN connections if possible
- Minimize hops packets traverse across network
- Upgrade outdated equipment introducing store-and-forward delays
For packet loss:
- Resolve wireless interference if on WiFi networks
- Check for errors introduced by network hardware like NICs, cables, switches
For small TCP windows:
- Configure window scaling options on servers and clients
- Upgrade operating systems lacking window scaling support
- Increase receiver buffer sizes being exhausted
For security control latency:
- Limit inspection only to necessary traffic
- Exclude trusted traffic from analysis
- Upgrade models with faster throughput
- Move security off network path with SPAN ports
My friend, you now have expert techniques to slay network latency beasts! Wireshark‘s visibility combined with these troubleshooting steps will have you resolving delay issues in no time. Let me know if you have any other questions!
