0

Practically I'm looking for a way to view lagging connections, especially dns connections(udp:53).

The closest I've got was using tcptrack as it shows idle time, but unfortunately it's only for tcp connections and there is no way to sort by idle time.

What is the simplest way to do this, practically I'm looking for a netstat command with a connection duration/idle column. It can be a GUI as for now I just want to do some monitoring and see what's holding back.

Improve this question
4
  • UDP is connectionless, so there is no "UDP connection". Determining whether a UDP-based interaction is lagging, in general, requires knowledge about the application. That is to say, we cannot conclude that just because a UDP server has received a packet and not immediately sent a reply in the opposite direction that it is not responsive. And vice versa: a seemingly immediate reply could actually be a lagged reply to an earlier request. Proper UDP monitoring means peeking inside the packets to parse the application-specific info, like matching request/reply identifiers.
    – Kaz
    Apr 11, 2013 at 15:24
  • That was exactly what I was finding out at the moment :) Thanks for the enlightenment. Could this be done in Wireshark? I was actually trying to group by dns and see if there are any problems with any of them, as it seems that my libcurl application is dns bound from looking at stacks (using pmp)
    – Stefan Rogin
    Apr 11, 2013 at 16:17
  • With Wireshark in real time? Maybe if it had some scriptability. Certainly its dissector framework would be useful for something like that. I see that "Lua has been added to Wireshark for scripting". Hmm! I have to take a look into that. Also, Wireshark logs could be analyzed textually for patterns, like matching requests to responses and tabulating the latency info from the timestamps.
    – Kaz
    Apr 11, 2013 at 17:34
  • just run Wireshark as root and it has an option to capture data and even prefilter it. I've found that it dose group-ing and calculates the time betwen query and response(at dns response details), but I'm not so shure of it's accuracy or if it takes into account the time to send the query.
    – Stefan Rogin
    Apr 11, 2013 at 17:57

1 Answer 1

Reset to default
2

I think you can use Wireshark to capture segment for some period and analyze it for tcp/udp for SYN and SYN-ACK responses. Plus it has nice UI. And though I have not tried but I think Wireshark dump should be compatible with cross platform usage, so you can use it in Windows for analysis too.

Improve this answer
3
  • There is no SYN or ACK in UDP.
    – Kaz
    Apr 11, 2013 at 15:05
  • I guess I was thinking of TCP only. May be this Wireshark forum question will give you some idea ask.wireshark.org/questions/13441/…
    – JackLock
    Apr 11, 2013 at 15:14
  • Wireshark looks like a neat tool, wonder why I didn't hear of it until now, it has even it's own Q/A site.
    – Stefan Rogin
    Apr 11, 2013 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .