> tcpdump/wireshark simply... There's nothing simple about tcpdump/wireshark. Wireshark does deltas for you if you want and can even calculate the RTT at ever

> tcpdump/wireshark simply... There's nothing simple about tcpdump/wireshark. Wireshark does deltas for you if you want and can even calculate the RTT at every point in time during the lifetime of a TCP flow. Wireshark is fucking awesome and I'm sad you would say "simply provides..." :'( But if what you want is just to know the RTT for a 3 way handshake against a remote endpoint, try something like gotcping: https://github.com/pjperez/gotcping/releases https://github.com/pjperez/gotcping/releases tracetcp (and variants) is not what you want, because it calculates the time it takes for you to get a "TTL expired in transit" ICMP back except on the last hop. Gotcping and other avoid wasting your time by just testing the final endpoint.