A Hands-on Analysis of Latency Variation Using Wireshark

Introduction

Network latency basically refers to the delay that happens when data travels from one system to another. This delay directly affects how fast applications respond. In this experiment, Wireshark is used to capture network packets and observe how latency behaves under low, medium, and heavy traffic conditions. The aim is to understand how increasing traffic impacts network performance in a practical way.

Objectives

• To understand how latency can be measured using Wireshark
• To observe how network delay changes with different traffic levels
• To compare latency under low, medium, and heavy traffic
• To analyze latency using graphs for better understanding

Reference

Source: SharkFest – Finding the Latency

About the source:
This SharkFest session explains different ways to analyze latency using Wireshark, especially using timestamps and TCP stream analysis. It helped in understanding how to practically measure delay instead of just studying theory.

Architecture of the Work

The system used for this experiment acts as the client. It sends requests to an external server through a Wi-Fi router and the internet. Wireshark captures all the packets at the client side, and based on the captured data, latency and timing behavior are analyzed.

Procedure

Step 1: Wireshark was opened and the active network interface (Wi-Fi) was selected for packet capture.

Step 2: Packet capture was started before generating any traffic.

Step 3: Network traffic was generated using a Python (Scapy) script by varying the number of packets and the delay between them to simulate different traffic conditions.

Step 4: The Scapy script was executed separately for each traffic condition while Wireshark was capturing packets. The complete Python scripts used for traffic generation and graph analysis are provided in the GitHub repository.

Step 5: After sufficient packets were captured, the capture was stopped and saved as .pcapng files for each case.

Step 6: Display filters such as tcp were applied to focus on relevant packets.

Step 7: TCP streams were analyzed using the “Follow TCP Stream” option to observe packet flow.

Step 8: Time reference was set on selected packets to measure delay between packets.

Step 9: RTT graphs and TCP sequence graphs were generated using Wireshark for initial analysis.

Step 10: The captured files were further analyzed using Python to extract packet timing and latency-related metrics.

Step 11: A total of 20 graphs were generated to study latency behavior under different traffic conditions.

Step 12: All observations and graphs were compared to understand how latency varies with increasing traffic load.

Graph Analysis & Inferences

WIRESHARK GRAPHS

Graph 1: RTT vs Time (High Traffic)

Inference:

The RTT values in this graph show noticeable variation over time, indicating that latency is not constant under high traffic conditions. Although the overall RTT values remain relatively low, small fluctuations suggest the presence of congestion and queuing delays in the network. These variations highlight the dynamic nature of network performance when traffic load is high. The graph demonstrates that even when average latency appears stable, underlying fluctuations can still impact performance, making it important to analyze latency trends rather than relying solely on average values.

Graph 2: RTT vs Time (Low Traffic)

Inference:

The RTT values under low traffic conditions remain relatively stable with only minor fluctuations throughout the duration. This indicates that the network experiences minimal congestion and maintains consistent performance. However, the presence of slight variations suggests that latency is not entirely constant and may be influenced by system-level factors or background processes. The graph highlights that while low traffic generally results in stable latency, minor deviations can still occur, emphasizing the need for careful analysis even under seemingly ideal conditions.

Graph 3: TCP Sequence Graph (High Traffic)

Inference:

The TCP time sequence graph for high traffic shows sudden jumps in sequence numbers, indicating bursty transmission behavior. This suggests that packets are not being sent uniformly but rather in groups, which can lead to temporary delays and increased latency. Such burst patterns are commonly associated with congestion and buffering in the network. The graph demonstrates how high traffic affects the smooth flow of data, leading to irregular transmission patterns that can impact overall network performance and responsiveness.

Graph 4: TCP Sequence Graph (Low Traffic)

Inference:
The TCP time sequence graph under low traffic conditions shows a smooth and steady increase in sequence numbers. This indicates that packets are being transmitted in a consistent and orderly manner without interruptions. The absence of abrupt jumps suggests minimal congestion and stable network behavior. This steady progression reflects predictable latency and efficient communication. The graph highlights how low traffic conditions support uniform data flow, resulting in reliable and consistent network performance.

Graph 5: TCP Sequence Graph (Medium Traffic)

Inference:
The TCP time sequence graph for medium traffic shows moderate progression with slight irregularities in sequence numbers. While the transmission is generally smooth, occasional variations indicate the presence of moderate network load. These irregularities suggest that packets may experience slight delays due to increased traffic. However, the behavior is not as bursty as in high traffic conditions. This graph reflects a balanced network state where latency is affected but still remains relatively controlled.

SCAPY-BASED GRAPHS

Graph 6: Latency vs Time (Low Traffic)

Inference:The latency values in this graph remain low for most of the duration, indicating stable network performance under low traffic conditions. However, a few sharp spikes are observed, representing occasional delays in packet transmission. These spikes suggest that latency is influenced by factors beyond traffic load, such as system processing or temporary interruptions. The graph demonstrates that even under low traffic, latency is not perfectly stable and can exhibit sudden variations that impact performance.

Graph 7: RTT vs Packet (Low Traffic)

Inference: 

This graph shows that the majority of packets experience very low delay, indicating efficient communication under low traffic. However, a few packets exhibit significantly higher latency, creating noticeable spikes. These variations suggest intermittent disruptions or processing delays that affect certain packets. The graph highlights that while low traffic conditions generally maintain low latency, occasional anomalies can still occur, emphasizing the importance of analyzing individual packet behavior rather than relying solely on averages.

Graph 8: Latency Distribution (Low Traffic)

Inference:
The latency distribution is heavily concentrated near zero, indicating that most packets experience minimal delay. However, the presence of a few higher values creates a long tail in the distribution, representing outliers. These outliers indicate occasional high latency events that deviate from the normal pattern. The graph shows that while overall performance is stable, rare but significant delays can still occur, affecting the consistency of network performance.

Graph 9: Moving Average Latency (Low Traffic)

Inference:
The moving average latency initially remains low, reflecting stable network conditions. However, it gradually increases at certain intervals, indicating periods of higher delay. These increases suggest that latency variations occur in clusters rather than randomly. The smoothing effect of the moving average highlights underlying trends more clearly. This graph demonstrates that even under low traffic, latency can temporarily increase due to transient factors.

Graph 10: Latency Trend (Low Traffic)

Inference:
The latency trend shows a mostly stable pattern with occasional spikes. These spikes represent irregular delays in packet transmission. While the baseline latency remains low, the presence of peaks indicates variability in network performance. This graph confirms that low traffic does not guarantee completely stable latency and that occasional fluctuations can still occur due to external influences.

Graph 11: Latency vs Time (Medium Traffic)

Inference:
The latency pattern under medium traffic conditions shows a noticeable increase in variability compared to low traffic. Instead of remaining mostly stable, the values fluctuate more frequently, indicating that packets are experiencing varying delays. This behavior suggests that the network is beginning to experience moderate load, leading to occasional queuing and processing delays. The absence of extremely large spikes, as seen in low traffic, indicates that the delay is more evenly distributed. Overall, the graph reflects a transition phase where latency is no longer stable but not yet highly unstable, highlighting the impact of increasing traffic on network performance.

Graph 12: RTT Proxy (Medium)

Inference: 

The RTT proxy values in this graph exhibit multiple spikes distributed across the timeline, indicating that packets are experiencing intermittent delays. Unlike low traffic, where spikes are rare and isolated, medium traffic shows a more consistent occurrence of these variations. This suggests that the network is under moderate load, causing temporary congestion and increased processing time for packets. The presence of repeated peaks highlights that latency fluctuations are not random but occur more frequently due to sustained activity. This graph demonstrates how moderate traffic levels can introduce instability in packet timing without completely disrupting network performance. 

Graph 13: Medium Traffic – Latency Distribution

Inference:

 The latency distribution for medium traffic is wider compared to low traffic, indicating a greater spread of delay values. While a significant number of packets still experience low latency, a noticeable portion falls into moderate latency ranges. This suggests that the network is handling increased load, resulting in more variability in packet delivery times. The distribution does not show extreme outliers but reflects a gradual shift towards higher latency values. This balanced spread indicates that delay is becoming more consistent across packets, highlighting the effect of moderate congestion on overall network behavior.

Graph 14: Medium Traffic – Moving Average Latency

Inference:
The moving average latency graph shows clear fluctuations with visible peaks at different intervals. Unlike low traffic, where the moving average remains mostly flat, medium traffic introduces noticeable upward trends in certain regions. These peaks indicate periods where latency temporarily increases due to higher network activity. The smoothing effect of the moving average highlights these trends more clearly, showing that delays are not isolated but occur over short durations. This graph demonstrates that medium traffic results in sustained variations in latency, making network performance less predictable compared to low traffic conditions.

Graph 15: Medium Traffic – Latency Trend

Inference:
The latency trend under medium traffic conditions shows a mix of moderate spikes and continuous fluctuations. The pattern indicates that latency is no longer stable and varies throughout the duration of the capture. Unlike low traffic, where spikes are rare, medium traffic exhibits more frequent irregularities, suggesting increased network load. The graph reflects a state where the system is actively handling multiple packets, leading to occasional delays. This behavior highlights the growing impact of traffic on latency and demonstrates that network performance becomes less consistent as load increases.

Graph 16: High Traffic – Latency vs Time (IAT)

Inference:
Under high traffic conditions, the latency values show continuous fluctuations with frequent peaks throughout the timeline. Unlike medium traffic, where variations are moderate, high traffic results in persistent changes in delay. This indicates that the network is under heavy load, leading to frequent queuing and processing delays. The absence of long stable regions suggests that latency is consistently affected by traffic. This graph clearly demonstrates that high traffic conditions introduce significant instability in network performance, making latency highly dynamic and unpredictable.

Graph 17: High Traffic – RTT Proxy (IAT)

Inference:
The RTT proxy values under high traffic conditions show multiple spikes occurring regularly across the graph. Unlike low traffic, where spikes are rare but large, high traffic shows frequent but relatively controlled variations. This indicates sustained congestion in the network, where packets consistently experience delays due to heavy load. The repeated peaks suggest that the network is continuously processing a high volume of packets, leading to ongoing latency fluctuations. This graph highlights the impact of heavy traffic on packet timing and demonstrates how latency becomes more dynamic under such conditions.

Graph 18: High Traffic – Latency Distribution

Inference:
The latency distribution under high traffic shows a broader spread of values compared to both low and medium traffic. While many packets still fall within lower latency ranges, a significant number experience moderate delays. This indicates that the network is consistently handling higher load, resulting in increased variability in packet delivery times. The absence of extreme outliers suggests that delays are more uniformly distributed rather than isolated. This graph demonstrates how high traffic leads to a wider range of latency values, reflecting reduced consistency in network performance.

Graph 19: High Traffic – Moving Average Latency

Inference:
The moving average latency under high traffic shows continuous variation without any prolonged stable regions. This indicates that the network is under constant load, with latency being affected throughout the duration of the capture. The graph does not show sharp isolated peaks but rather a fluctuating pattern, suggesting sustained congestion. The smoothing effect highlights that delays are not momentary but persist over time. This graph clearly reflects the impact of heavy traffic on network stability, where latency remains consistently variable.

Graph 20: High Traffic – Latency Trend

Inference:

The latency trend for high traffic is highly irregular, with frequent fluctuations observed throughout the graph. This indicates that the network is experiencing continuous changes in delay due to heavy traffic conditions. Unlike low traffic, where spikes are occasional, high traffic results in persistent variability. The pattern suggests that packet transmission is consistently affected by congestion and processing delays. This graph highlights the unstable nature of latency under heavy load and emphasizes the need for effective traffic management to maintain performance.

Graph 21: Average Latency vs Traffic Load

Inference:
The average latency across different traffic conditions does not show a significant linear increase. While slight differences may be observed, the values remain relatively close. This indicates that average latency alone is not a reliable indicator of network performance. The presence of spikes and variability in other graphs suggests that important details are hidden when only average values are considered. This graph highlights the limitation of relying solely on average latency and emphasizes the need to analyze additional metrics such as variation and maximum delay.

Graph 22: Maximum Latency vs Traffic Load

Inference:

The maximum latency values show that low traffic conditions can sometimes produce higher peak delays compared to medium and high traffic. This is due to the presence of isolated spikes observed in earlier graphs. In contrast, high traffic shows more consistent but controlled peaks. This indicates that maximum latency is influenced not only by traffic load but also by rare events. The graph highlights the importance of considering peak values in performance analysis, as they represent worst-case scenarios that can impact user experience.

Graph 23: Latency Variation (Standard Deviation)

Inference:
The standard deviation of latency values indicates how much variation exists in packet delays. The graph shows that low traffic has higher variation due to occasional large spikes, while medium and high traffic exhibit more consistent variation patterns. This suggests that variability is influenced by both the frequency and magnitude of delays. High traffic results in frequent but controlled fluctuations, whereas low traffic shows rare but extreme variations. This graph emphasizes the importance of analyzing variability to understand network performance more accurately.

Graph 24: Latency Trend Comparison

Inference:
This graph compares latency trends across different traffic conditions, highlighting distinct patterns for each. Low traffic shows mostly stable behavior with occasional large spikes, while medium traffic introduces moderate and more frequent fluctuations. High traffic, on the other hand, exhibits continuous variability with frequent but smaller peaks. This comparison clearly demonstrates that different traffic levels produce different latency behaviors. The graph provides a comprehensive view of how network performance evolves with increasing load.

Graph 25: Cumulative Latency Growth

Inference:
The cumulative latency graph shows how delay accumulates over time for different traffic conditions. Under medium and high traffic, latency increases steadily, reflecting consistent network activity. In contrast, low traffic shows sudden jumps due to isolated spikes. This indicates that cumulative delay is influenced by both the frequency and magnitude of latency events. The graph highlights how overall performance can degrade over time, especially under sustained load, and emphasizes the importance of managing both average and peak delays.

New Findings & Recommendations

New Findings:

• Latency does not increase in a strictly linear manner with traffic load
• Even under low traffic, occasional high latency spikes are observed
• Medium traffic introduces more consistent variability in delay
• High traffic results in frequent fluctuations rather than isolated spikes
• Most packets experience low latency, but a few significantly impact overall performance

Recommendations:

• Avoid relying only on average latency; consider maximum and variation as well
• Monitor networks for sudden latency spikes even during low usage
• Use controlled traffic generation for accurate performance analysis
• Implement congestion control techniques to reduce delay under heavy load
• Regular latency analysis can help in early detection of network issues

Use of AI in this Blog

AI tools were used mainly to understand concepts, structure the workflow, and assist in organizing the analysis. However, the actual implementation, including packet capture, traffic generation using Scapy, and graph plotting, was carried out manually. The interpretations and observations were based on the obtained results.

Conclusion

This experiment focused on analyzing network latency under different traffic conditions using Wireshark and Python-based tools. The results showed that latency is influenced not only by traffic load but also by unpredictable system and network factors. While higher traffic leads to more frequent fluctuations, lower traffic can still produce sudden spikes. This highlights the importance of analyzing multiple metrics such as variation and distribution rather than relying on average latency alone. Overall, the study provided a practical understanding of how network performance behaves under real-world conditions.

YouTube Video Link: https://youtu.be/wmTOstE1glQ

GitHub Repository Link:  https://github.com/Shivani-vit28/WireShark_Latency_Analysis

References

1. SharkFest – Finding the Latency (Ray Tompkins):   https://sharkfestus.wireshark.org/assets/presentations09/RT06-Finding-Latency.pdf
2. Wireshark Official Documentation:  https://www.wireshark.org/docs/
3. Scapy Official Documentation:  https://scapy.readthedocs.io/en/latest/

Acknowledgement

I would like to express my gratitude to my parents, VIT University, VIT SCOPE, and Dr.Subbulakshmi T for their guidance and support. I also thank my friends and available online resources that helped me complete this blog successfully.