4 ms·
> Wireshark and a spreadsheet are enough. So you have packet captures from your local machine, and from the VPS running the onion service. Using Wireshark, you
by zamber 9y ago
> Wireshark and a spreadsheet are enough. So you have packet captures from your local machine, and from the VPS running the onion service. Using Wireshark, you export bitrate in millisecond bins. Then in the spreadsheet, you have two columns, one with each bitrate series. Just create a third column for the product. Each sheet will hold 1E6 lines, or 1000 seconds. Excel works best, because it uses multiple cores. R would be better, because you could crunch segments in parallel.
Wireshark alone is enough http://blog.davidvassallo.me/2010/03/22/measuring-bandwidth-using-wireshark/ http://blog.davidvassallo.me/2010/03/22/measuring-bandwidth-...
If you would want to really see if there are differences in bandwidth for 2 pcap files you would have to graph it cumulatively.
I may have something to do that in Python.
- mirimir 9y agoSure. That shows throughput. And you can compare captures visually. But to do correlation, you need something more quantitative. The old school way is sampling and multiplication. But fancier stuff is possible now. You can look at additional measures, not just amplitude. Packet type, for example. Or components of TCP conversations. But Tor-specific parameters are buried in encrypted payloads, so amplitude is decent enough.
- zamber 9y ago> You can look at additional measures, not just amplitude. Packet type, for example. Or components of TCP conversations Yes, I did that too. Had to analyze traffic to QA a VPN app. > But Tor-specific parameters are buried in encrypted payloads, so amplitude is decent enough. Indeed it is. It's even possible to do traffic shape fingerprinting on that.