RTT timing for TCP packet using Wireshark
networking, tcp, wireshark
Solution
There is nothing inside TCP that gives the round-trip time. It's estimated by the kernel based on how long it takes to receive an ACK to data that was sent. It records the timestamp of when a given sequence number went out and compares it to the timestamp of the corresponding ACK. The initial 3-way handshake gives a decent starting value for this.
However, this is only an estimate as the receiver is free to delay ACKs for a short period if it feels it can respond to multiple incoming packets with a single reply.
RTT frequently changes over the duration of the session due to changing network conditions. The effect is (obviously) more pronounced the further away the endpoints.
Problem
I want to calculate the Round Trip timing for the TCP packets. But in wireshark, I don't see any particular field for the RTT timing for a TCP packet like its there for the RTP packet. Wireshark do calculates the RTT graph but i am not finding as how it has been calculated. Can someone help me out in finding the formula used for the same?