Analysis of Network Throughput using Wireshark
Author details:
Ms. G Anushree II year B.Tech. CSE student, School of Computer Science and Engineering , VIT Chennai
Introduction:
In today’s digital world, networks play a crucial role in enabling seamless communication and data exchange. One of the key factors that defines network performance is throughput, which represents the rate at which data is successfully transmitted over a network.
Understanding throughput is essential for analyzing how networks behave under different conditions. By observing traffic patterns and visualizing data flow over time, it becomes possible to identify performance trends, stability, and potential congestion.
This blog presents a clear and structured view of network throughput, using graphical analysis to illustrate how data transmission evolves with changing traffic intensity.
Obejectives:
- To understand the concept of network throughput and its importance in evaluating network performance.
- To analyze how data transmission varies under different traffic conditions.
- To visualize network behavior using graphical representations for better interpretation.
- To visualize network behavior using graphical representations for better interpretation.
- To gain insights into how increasing traffic intensity impacts overall network efficiency.
PCAP Description
The PCAP (Packet Capture) file contains the recorded network traffic captured during the analysis process. It includes detailed information about each packet transmitted over the network, such as source and destination addresses, protocol type, packet size, and timing information.
This captured data serves as the foundation for analyzing network behavior and performance. By examining the PCAP file in tools like Wireshark, it becomes possible to visualize traffic patterns, measure throughput, and identify variations in data transmission over time.
The PCAP data provides a structured and accurate representation of real-time network activity, enabling deeper insights into how networks operate under different traffic conditions.
Architecture of Work :
Procedure of work :
The system is prepared with the required tools for traffic generation and analysis. The network interface is selected to monitor active data transmission.
2. Traffic Generation
Network traffic is generated using hping3, allowing controlled variation in traffic intensity to observe different network conditions.
3. Packet Capture
The generated traffic is captured in real time using Wireshark, ensuring that all relevant packets are recorded for analysis.
4. Data Recording
The captured traffic is stored in PCAP format, preserving detailed packet-level information such as timestamps, protocols, and data size.
5. Data Filtering
Relevant traffic is isolated using appropriate filters (e.g., ICMP), enabling focused and accurate analysis of the required data.
6. Throughput Visualization
The processed data is visualized using I/O graphs, representing throughput in terms of bytes per second and bits per second over time.
7. Analysis and Interpretation
The generated graphs are analyzed to observe traffic patterns, identify variations, and understand how network performance changes with traffic intensity.
Traffic Generation using hping3
Normal Traffic
Medium Traffic
Heavy Traffic
Filters Used While capturing the traffic
1.Throughput vs Time (TCP)
2. Throughput vs Time (UDP)
tcp
Purpose: Analyze TCP traffic
3. Throughput vs Time (HTTP – Port 80)
udp
Purpose: Capture UDP packets
4. Throughput vs Time (HTTP – Port 443)
ip
Purpose: View all IP traffic
5. Throughput vs Time (fram.len<200)
tcp.flags.syn == 1
Purpose: Identify connection requests
6. Throughput vs Time (fram.len>1000)
tcp.flags.ack == 1
Purpose: Track acknowledgements
7. No Filter (All Packets)
no filter
Purpose: Overall traffic overview
Flags Used
🔸 Throughput vs Time (TCP)
tcp.flags.syn == 1
Meaning: Connection start
Purpose: Initiate TCP connection
🔸 Throughput vs Time (UDP)
tcp.flags.ack == 1
Meaning: Acknowledgement
Purpose: Confirm packet delivery
🔸 Throughput vs Time (HTTP – Port 80)
Meaning: Response to SYN
Purpose: Connection handshake step
🔸 Throughput vs Time (HTTPS – Port 443)
tcp.flags.fin == 1
Meaning: Connection close
Purpose: Terminate connection
🔸 Throughput vs Time (fram.len<200)
tcp.flags.reset == 1
Meaning: Reset connection
Purpose: Abort connection
🔸 Throughput vs Time (fram.len>1000)
tcp.flags.reset == 1
Meaning: Reset connection
Purpose: Abort connection
Result and Analysis
Normal Traffic:
1.Throughput vs Time (TCP)
2.Throughput vs Time (UDP)
This graph represents UDP throughput over time. The throughput is low and shows slight variations since UDP does not use acknowledgements. Data transmission is simple and steady in normal traffic conditions.
3.Throughput vs Time (HTTP – Port 80)
This graph shows throughput for HTTP traffic. The values are low because only basic web browsing is happening. The graph shows small spikes when web pages are loaded.
5.Throughput vs Time (HTTPS – Port 443)
This graph represents secure web traffic throughput. The throughput is slightly higher than HTTP due to encryption overhead. However, it still remains low under normal conditions.
Throughput vs Time (fram.len<200)
This graph shows throughput for small-sized packets. The throughput is low because small packets carry less data. The graph is smooth and stable with minimal variation.
Throughput vs Time (fram.len>1000)
This graph represents throughput for large packets. Slightly higher throughput is observed compared to small packets. However, overall traffic remains low in normal conditions.
7. No Filter (All Packets)
Without any filter, normal traffic appears clean and stable with minimal packet activity. The network shows low utilization and consistent performance. This reflects an ideal operating condition.
Medium Traffic:
8. Throughput vs Time (TCP)
9.Throughput vs Time (UDP)
This graph represents UDP throughput in medium traffic. The throughput is higher than normal traffic and shows irregular variations. Since UDP does not have flow control, sudden spikes are observed.
10.Throughput vs Time (HTTP – Port 80)
This graph shows HTTP traffic throughput. Moderate spikes are seen when web pages or resources are loaded. The throughput is higher than normal traffic due to more browsing activity.
11. Throughput vs Time (HTTPS – Port 443)
This graph represents HTTPS throughput. The throughput is moderate with fluctuations due to encrypted communication. Slightly higher values are observed compared to HTTP.
12.Throughput vs Time (fram.len<200)
During medium traffic, the number of SYN packets increases as more connections are initiated.The network shows moderate growth in communication requests.This reflects increased usage.
13.Throughput vs Time (fram.len>1000)
With medium traffic, ACK packets increase in frequency as more data is transmitted. The network shows active communication with moderate variations.This reflects a balanced yet busy state.
14. No Filter (All Packets)
In medium traffic, the overall packet count increases,showing moderate network activity.The traffic becomes denser with visible variations.This indicates increased usage without overload.
Heavy Traffic:
15. Throughput vs Time (TCP)
This graph shows TCP throughput over time under heavy traffic conditions. The throughput is very high with large fluctuations and frequent spikes. This indicates a high volume of data transmission. Some variations occur due to congestion control mechanisms.
16. Throughput vs Time (UDP)
This graph represents UDP throughput in heavy traffic. The throughput is high and highly irregular with sudden spikes. Since UDP does not control flow, it leads to bursty transmission in heavy traffic.
17. Throughput vs Time (HTTP – Port 80)
This graph shows HTTP throughput under heavy traffic. Large spikes are observed when multiple web requests occur. The throughput is high due to increased data exchange.
18. Throughput vs Time (HTTPS – Port 443)
This graph represents HTTPS throughput. The throughput is very high with noticeable fluctuations. Encryption adds overhead, resulting in slightly higher values compared to HTTP.
19. Throughput vs Time (fram.len<200)
This graph shows throughput for small packets. Even though packet size is small, the large number of packets increases overall throughput. Frequent fluctuations are observed.
20. Throughput vs Time (fram.len>1000)
This graph represents throughput for large packets. The throughput is very high due to larger data size per packet. Peaks indicate heavy data transfer.
FINDINGS
-
Throughput increases with traffic intensity, reaching its highest values under heavy traffic conditions.
- Normal traffic shows stable and smooth behavior with minimal fluctuations and no congestion.
-
Medium traffic introduces moderate variations, indicating increased network activity while maintaining overall stability.
-
Heavy traffic leads to sharp spikes and instability, clearly indicating network congestion and performance degradation.
-
Different filters help isolate traffic patterns, enabling better understanding of protocol-wise behavior in the network.
-
High packet density and connection activity under heavy load result in network saturation and reduced efficiency.
INFERENCE
The analysis indicates that network throughput is directly influenced by traffic intensity. As the volume of traffic increases, the rate of data transmission also increases; however, this improvement is accompanied by instability and congestion under heavy load conditions.
It can be inferred that while networks are capable of handling moderate traffic efficiently, excessive traffic leads to performance degradation, irregular data flow, and reduced reliability.
Therefore, effective traffic management and control mechanisms are essential to maintain optimal network performance and prevent congestion in high-load scenarios.
ACKNOWLEDGMENT
I would like to express my sincere gratitude to the School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology (VIT), Chennai, for offering the theory and laboratory courses in Computer Networks during the Winter Semester 2025–2026 with an industry-standard syllabus.
I extend my heartfelt thanks to my course faculty, Dr. T. Subbulakshmi, Professor, SCOPE, VIT Chennai, for her valuable guidance, continuous support, and encouragement throughout the completion of this work.
I would also like to acknowledge Gerald Combs, the founder of Wireshark and ACM Software System Award winner (2018), for providing an excellent tool that greatly helped in analyzing network traffic effectively.
I express my appreciation to Bradley Duncan for his informative blogs on malware analysis, which helped in understanding the effects of malware without executing them and encouraged deeper analytical learning.
I am thankful to my peers for their support, valuable suggestions, and collaborative learning throughout this work.
I am also grateful to my parents, siblings, and relatives for their constant support, encouragement, and motivation.
Finally, I acknowledge all the books, websites, and other resources that I have referred to for completing this work successfully.
AI TOOLS USED
Artificial Intelligence tools were used to assist in both the analysis and presentation of the work. They helped in interpreting network traffic patterns, identifying key observations, and understanding variations in throughput under different conditions. AI also supported in organizing the findings into clear, structured insights and improving the overall clarity of the content. This enhanced both the accuracy of the analysis and the quality of the final presentation.
CONCLUSION
The analysis of network traffic using Wireshark demonstrates how throughput varies under different traffic conditions. It is observed that throughput increases from normal to heavy traffic, reflecting higher data transmission rates as network load increases. However, this increase is accompanied by instability and congestion under heavy traffic conditions, affecting overall network performance.
The study highlights the importance of efficient traffic management to maintain stability and ensure optimal performance in high-load environments. Overall, the analysis provides a clear understanding of how networks behave under varying levels of demand.
Clear, insightful explanation of throughput with effective graphical analysis, making complex network performance concepts easy to understand and visually engaging.
ReplyDeleteVery well explanation of graphs,really helpful in understanding the comparison between traffics
ReplyDeleteWell explained through the graphs! Helped me understand the concept very well!!
ReplyDeleteGreat explanation. Helped me understand the concept easily and quickly..
ReplyDeleteThe progressive analysis across traffic intensities effectively illustrates the relationship between load and throughput variability, Great job!
ReplyDeleteReally enjoyed reading this! The way you’ve explained throughput and connected it with practical analysis using Wireshark makes it much easier to understand a concept that usually feels quite abstract.
ReplyDeleteGreat work!! Very well explained
ReplyDeleteGreat work. Well explained through the diagrams and actual examples used in the article. Even the language used is simple and clear and easy to understand.
ReplyDelete