Posts

Showing posts from July, 2017

Ask a stupid question...

I was staring at some tprof output today, which is not something I often look at.  It took me quite a while to realize that CPU usage in the "shared" column (contrast with "Kernel" and "User") simply meant CPU usage accumulated in shared library  code.

Showing HTTP requests with no HTTP responses in wireshark

Large packet captures, with little corroborating information like a time or ephemeral port of interest, can be annoying to work with.  One old trick is to add a column that shows "http.time" which allows you to quickly look at the quickest and slowest TTFB transactions. One shortcoming to this sort is that it doesn't show you data for requests that had no HTTP response captured. This can either be due to a prolonged hang, or bad luck at the end of a capture.  To check for these directly, you can filter on ""http.request && !http.response_in" which will show you requests that never got a response (http.response_in is used internally by the dissector when piecing together http.time values)