Scroll through the graph in order to identify bursts. Change the tick interval to X Axis=0.001 sec and the scale to Y-axis= (bits/tick). Recalculate the scales on the X and Y-axes. Change the Y-axis to bits/tick because interfaces show output rates in bits/sec. If you make the scales more granular, you see a more accurate picture of the actual traffic profile. However, if a major portion of this traffic attempts to leave the interface in a fraction of a second, the switch needs to extensively buffer packets and drop them when the buffers are full.

In a period of one second, a 1 Gb/s link can accommodate 1000 Mb of traffic across the interface in a neatly-shaped profile with a minimum need to buffer any packet.

However, one second is a very large interval when you consider the rate at which buffering and packet switching happens. Open the captured file in Wireshark and plot an IO graph like this one.Īt the default scale, it appears that there is no bursty traffic. In order to capture this traffic, connect a PC that runs Wireshark and capture packets at the mirror destination port.

For example, you notice output drops on a 1G link while the average utilization of the link is only 150Mb.Ĭonfigure an egress mirror on the switch in order to capture transmitted (TX) traffic. Prior to the capture, make sure that the switch port and that the AP are resolving at 1000 BT for numbers to be valid.Identify an interface that has incremental output drops. We see that IPv4 TCP and UDP take the majority of the percent of total packets, UDP taking 81% of total traffic. We see that IPv6 traffic is not high relative to the percent of total packets. Above 6k is a somewhat high number if the packet size is big. When we see above 6k packets/sec is when we need to stop and look at the size of the packets and analyze as packet sizes. We see a total of 506,060 packets between a 710 second period.ħ12 packets/sec is an OK number. Once you have a Wireshark capture of the AP, from a mirrored port on the switch, click on the Statistics / Summary: ResolutionThere are instances where we need to analyze the packets per second at an AP mirrored wire interface so that we can take a look at how many packets per second and/or the protocol percentage of the traffic passing that the AP sees. Both switch and AP negotiating at 1000 BT. QuestionHow to look at packets per second and protocol hierarchy in packet capture? Customer EnvironmentAP/ZD and/or standalone AP packet capture done at ethernet interface. SummaryWhen doing a wireshark analysis, take a look at the packets per second, ipv6 count, and the protocol hierarchy to get idea of traffic type percentages.

Wireshark packet capture bandwidth