Mailing List Archive

-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

Usman,

You should probably ask this on Wireshark-users rather than Ethereal-users as this list is deprecated

Anyway, there is no definitive answer to your question. Ethereal/Wireshark doesn't have a overhead calculator built in. Also, there is a big question as to by what do you mean overhead? Do you mean everthing this isn't displayed as text in the browser i.e. in HTML like <B>Bold text</B> - are the <B> & </B> tags overhead? Or what about HTTP headers such as "Accept-Language: en-au\r\n" - are these overhead? (And is image compression such as GIF underhead (is that a word) ????)

If you just want to take away the PPP/Ethernet/IP/TCP layers away from the HTTP content an easy way is to right-click on a stream and select "Follow TCP Stream" you will get a dialog popup. The value at the bottom shows the total of the data portion of the TCP stream, which pretty well is the HTTP data. If you then close this box and then open the menu item "Statistics:Protocol Hierarchy" you will be able to see the total size of frames transmitted. (there is also a HTTP leaf - which is different from the previous value - I'm not sure why the diff - you may want to investigate). Subtracting the smaller number from the larger number should give you an idea of the overheads, at least as previously defined.

Martin Visser

Technology Consultant
Consulting & Integration
Technology Solutions Group - HP Services

410 Concord Road
Rhodes NSW 2138
Australia

Mobile: +61-411-254-513
Fax: +61-2-9022-1800
E-mail: martin.visserAThp.com

This email (including any attachments) is intended only for the use of
the individual or entity named above and may contain information that is
confidential, proprietary or privileged. If you are not the intended
recipient, please notify HP immediately by return email and then delete
the email, destroy any printed copy and do not disclose or use the
information in it.



________________________________

From: ethereal-users-bounces@ethereal.com on behalf of Usman Qureshi
Sent: Tue 19/09/2006 1:45 PM
To: ethereal-users@ethereal.com
Subject: [Ethereal-users] HTTP Protocol



-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org <http://www.wireshark.org/> and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------



_______________________________________________
Ethereal-users mailing list
Ethereal-users@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-users

-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

Usman,

My questions around overhead are really for you to answer. Once you
decide what you consider is overhead then you can do the appropriate
maths. My suggestion is to probably understand the protocol and
application interactions that you are interested, and possible draw the
flows and encapsulation.

You haven't really stated what purpose you need to know the "overhead".
All computer activity has overhead - usually the amount of overhead is a
tradeoff between being flexible and maintainable and costs in terms of
storage, processing and transmission. With the CPU, memory, storage and
bandwidth all becoming more capable there is a tendency to increase
overhead to make applications more capable.

Wireshark certainly aids you in understanding these characteristics in
an objective fashion, but unfortunately won't give you all the answers
unless you are able more clearly understand what you require.

Regards, Martin


Martin Visser

Technology Consultant
Consulting & Integration
Technology Solutions Group - HP Services

410 Concord Road
Rhodes NSW 2138
Australia

Mobile: +61-411-254-513
Fax: +61-2-9022-1800
E-mail: martin.visserAThp.com

This email (including any attachments) is intended only for the use of
the individual or entity named above and may contain information that is
confidential, proprietary or privileged. If you are not the intended
recipient, please notify HP immediately by return email and then delete
the email, destroy any printed copy and do not disclose or use the
information in it.


-----Original Message-----
From: ethereal-users-bounces@ethereal.com
[mailto:ethereal-users-bounces@ethereal.com] On Behalf Of Usman Qureshi
Sent: Wednesday, 20 September 2006 5:00 AM
To: Ethereal user support
Subject: Re: [Ethereal-users] HTTP Protocol

-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

_______________________________________________
Ethereal-users mailing list
Ethereal-users@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-users