A Practical Study of Network Latency Dynamics using Wireshark and Controlled Traffic Generation.

Introduction:-

Network performance analysis is essential for evaluating the efficiency and responsiveness of data transmission under varying traffic conditions. Among different performance metrics, latency is a critical parameter as it determines the time required for data to travel from source to destination, directly impacting application performance and user experience.

This study focuses on analyzing latency using Wireshark, a powerful network protocol analyzer that enables packet-level inspection. Controlled traffic conditions are generated using command-line tools to simulate different levels of network load. The analysis aims to observe how latency varies across these conditions and to understand its behavior under increasing traffic intensity.

The insights obtained from this analysis provide a deeper understanding of network performance dynamics and highlight the importance of managing latency for efficient and reliable communication.

Objectives:-

The primary objective is to measure and analyze network latency using Wireshark under controlled traffic conditions. It aims to evaluate the impact of varying traffic loads on latency and observe its behavior through packet-level analysis. Latency variations are visualized using graphical methods to derive meaningful insights for improving network responsiveness and overall performance.

References:-

Source: SharkFest – Finding the Latency

About the source:- The work is based on insights from a SharkFest presentation titled “Finding the Latency” by Ray Tompkins. The resource explains how latency can be analyzed using Wireshark by examining packet time differences and network delays. It also highlights key components of latency such as insertion delay, distance delay, and queue delay, along with practical techniques for measuring round-trip time (RTT) using packet captures.

Link:- https://sharkfest.wireshark.org/retrospective/sfus/presentations09/au-8-tompkins-gearbit-wireshark-finding-the-latency-sharkfest09.pdf?utm_source=chatgpt.com

Architecture Diagram:-

The architecture illustrates the complete workflow for analyzing network latency under varying traffic conditions using Wireshark and Scapy. The process begins with the client system, which acts as the traffic generator. Controlled traffic is generated using command-line tools such as ping or hping3, with different levels categorized as low, medium, and high traffic to simulate real-world network conditions.

The generated traffic is transmitted through the Wi-Fi router, which serves as the network device, and then flows through the network (Internet or LAN) to reach the remote server. This establishes end-to-end communication between the client and the server. During this transmission, packets travel across the network, and their behavior varies depending on the traffic load.

Wireshark is used to capture these packets in real time. It performs packet sniffing and records precise timestamps for each packet, allowing detailed packet-level inspection. The captured data is then passed through a protocol filtering layer, where specific protocols such as TCP and ICMP are isolated using display filters. This helps in focusing only on the relevant traffic for latency analysis.

After filtering, latency is extracted using parameters such as frame.time_delta and round-trip time (RTT). This step measures the time delay between packets and provides insights into network performance. The extracted latency data is further analyzed using Scapy, where packet-level computations and indexing are performed to identify patterns and variations.

Finally, the analyzed data is visualized using I/O graphs, which represent latency variations over time or packet index. These graphs help in understanding how latency behaves under different traffic conditions. Overall, the architecture provides a structured approach for capturing, analyzing, and visualizing network latency, enabling a deeper understanding of network performance.

Procedure:-

1. Open Wireshark and select the active network interface.

2. Start packet capture to record real-time traffic.

3. Generate normal traffic using: ping google.com. Apply filter TCP and observe RTT values.

4.Generate low traffic using: ping -c 50 google.com. Capture packets and analyze latency using timestamps.

5. Generate medium traffic using:

ping -c 200 google.com.

6. Observe variation in latency and analyze using I/O Graph.

7. Generate high traffic using:

ping -c 500 google.com or hping3 -c 500 google.com.

8.Capture high traffic and analyze delay variations.

9.Apply protocol filter: TCP to isolate relevant packets.

10. Measure latency using packet timestamps and round-trip time (RTT).

11.Navigate to Statistics → I/O Graph in Wireshark to generate graphs.

12. Compare latency behavior across all traffic conditions.

Graphs:-

1.Latency vs Time (Low Traffic Condition - Index 77)

Inferences:-

Latency values remain relatively low for most of the duration, indicating minimal network congestion.

A few sudden spikes are observed, suggesting occasional delay due to transient network conditions.

The overall trend shows stable RTT with limited fluctuations.

Packet transmission is efficient, with consistent response times.

The network maintains good performance under low traffic load.

2.RTT vs Time (Low Traffic Condition - Index 77)

Inferences:-

• RTT values remain low throughout the duration, indicating minimal network delay.
• Slight fluctuations are observed, reflecting normal variations in packet transmission time.
• A few peaks in RTT suggest temporary delay due to minor network processing or queuing.
• The overall pattern shows stable and consistent response times.
• No continuous high spikes are observed, confirming low network congestion. 

3. Latency vs Packet Number (Low Traffic Condition using Scapy - Index 77)

Inferences:-

• The majority of packets exhibit low latency, indicating efficient TCP communication under low traffic conditions.
• Several sharp spikes in latency are observed, suggesting occasional delays due to retransmissions or network processing overhead.
• Latency remains near zero for a continuous range of packets, indicating stable and congestion-free transmission periods.
• The presence of isolated high peaks indicates transient network disturbances rather than sustained congestion.
• Overall, the network demonstrates stable performance with minimal delay under low traffic load. 

4. RTT vs Packet Number (Low Traffic using Scapy - Index 77)

Inferences:-

Most RTT values remain low, indicating efficient packet transmission with minimal delay.

Two prominent spikes in RTT are observed, showing sudden increases in delay due to temporary network conditions.

The RTT quickly returns to low values after each spike, indicating stable network recovery.

The overall trend shows consistent and low latency for the majority of packets.

The absence of continuous high RTT values confirms low network congestion.

5. Latency vs Time (Low Traffic Condition - Index 82)

Inferences:-

• Latency remains low for most of the time interval, indicating efficient network performance under low traffic conditions.
• A sharp peak is observed in the initial phase, suggesting a temporary delay in packet transmission.
• Moderate fluctuations occur in the middle duration, reflecting minor variations in network conditions.
• Another noticeable increase in latency is observed later, indicating short-term congestion or processing delay.
• The latency decreases towards the end, showing that the network stabilizes after transient disturbances.

6. RTT vs Time (Low Traffic Condition - Index 82)

Inferences:-

• RTT values remain low for most of the time interval, indicating minimal network delay.
• A prominent peak is observed in the early phase, suggesting a temporary increase in round-trip time.
• RTT gradually decreases after the peak, indicating recovery from transient delay.
• Moderate fluctuations are observed later, reflecting minor variations in network conditions.
• The overall trend shows stable and efficient network performance under low traffic load.

7. Latency vs Packet Number (Low Traffic Condition using Scapy - Index 82)

Inferences:-

• Most packets exhibit low latency, indicating efficient TCP communication under low traffic conditions.
• Multiple sharp spikes in latency are observed at specific packet indices, suggesting occasional delays due to retransmissions or processing overhead.
• A long interval of near-zero latency is visible in the middle region, indicating a stable and congestion-free transmission period.
• High latency spikes reappear towards the later packets, reflecting transient network disturbances.
• The absence of continuous high latency confirms that congestion is not persistent but occurs intermittently.

8. Latency vs Time (Low Traffic Condition - Index 4)

Inferences:-

• Latency remains low during most of the time intervals, indicating efficient network performance.
• A significant peak is observed in the early phase, suggesting a temporary delay in packet transmission.
• After the peak, latency drops sharply and remains stable for a short duration, indicating quick network recovery.
• Moderate fluctuations are observed in the middle interval, reflecting minor variations in network conditions.
• Another increase in latency occurs later, indicating short-term congestion or processing delay.
• The latency decreases towards the end, showing stabilization of the network after transient disturbances.

9.RTT vs Time (Low Traffic Condition - Index 4)

Inferences:-

• RTT drops sharply at the beginning, indicating quick stabilization.
• A clear peak is observed early, showing a temporary delay spike.
• Mid-interval shows very low RTT, indicating a stable network phase.
• Later values rise gradually, showing mild delay variation.
• No continuous high RTT, so congestion is not persistent.

10.. Latency vs Packet Number (Low Traffic Condition using Scapy - Index 4)

Inferences:-

• Latency increases sharply from the first packet to the second, indicating a sudden delay rise.
• A clear peak is observed at the middle packet, representing the maximum delay.
• Latency then decreases significantly for the next packet, showing quick recovery.
• The pattern forms a triangular trend, indicating a temporary and isolated delay variation.
• Very few packets are involved, so delay variation is limited and not continuous. 

11.RTT vs Time (Low Traffic Condition Using Scapy - Index 4)

Inferences:-

• RTT remains almost negligible at the start, indicating immediate packet response.
• A sudden jump in RTT occurs for the middle packet, highlighting a single delayed response.
• The delay is not sustained, as RTT quickly drops back to a minimal value.
• The variation is concentrated at one point, showing isolated network delay rather than continuous fluctuation.
• This pattern suggests that delay is event-specific and not influenced by overall traffic load. 

12.Latency vs Time (Medium Traffic using Scapy –Index 207)

Inferences:-

• Latency rises sharply at the beginning, indicating increased delay under medium load.
• A higher peak compared to low traffic is observed, showing stronger impact of network usage.
• After the peak, latency decreases gradually rather than instantly, indicating slower recovery.
• Mid-interval shows very low latency, suggesting temporary stabilization.
• Later fluctuations reappear, showing inconsistent delay due to moderate congestion.
• Overall pattern indicates higher variability compared to low traffic conditions. 

 13.RTT vs Time (Medium Traffic Condition - Index 207)

Inferences:-

• RTT remains low initially, indicating stable start of transmission.
• Gradual increase is observed, showing rising delay with increased traffic.
• Multiple small fluctuations occur, indicating varying network response.
• A sharp spike appears towards the end, indicating sudden congestion or delay.
• RTT drops immediately after the spike, showing quick recovery.
• Overall pattern reflects unstable response compared to low traffic conditions.

14. Latency vs Packet Index (Medium Traffic using Scapy - Index 207)

Inferences:-

• Latency shows multiple high spikes, indicating frequent delay under medium traffic load.
• Initial packets exhibit very high peaks, suggesting burst transmission or congestion at the start.
• Middle region remains mostly low with occasional spikes, showing intermittent stability.
• Later packets again show clustered spikes, indicating repeated delay fluctuations.
• The variation is irregular and frequent, unlike the smoother pattern in low traffic.
• Overall behavior indicates moderate congestion with inconsistent latency.

15. RTT vs Packet Index (Medium Traffic using Scapy - Index 207)

Inferences:-

• RTT remains very low for most packets, indicating generally fast responses.
• A few moderate spikes appear, showing occasional delay variation.
• One extremely high spike is observed, indicating a significant delay or timeout event.
• The spike is isolated, not repeated, suggesting a sudden anomaly rather than continuous congestion.
• RTT quickly returns to normal after the spike, showing recovery of network performance.
• Overall pattern indicates stable communication with rare but severe delay events.

16. Latency vs Time (Medium Traffic - Index 145)

Inferences:-

• Latency increases rapidly at the start, indicating sudden load impact on the network.
• A sharp peak is followed by a steady decline, showing gradual normalization rather than instant recovery.
• Around the mid-interval, latency drops close to zero, indicating a brief stable transmission window.
• In the later phase, latency rises in smaller waves instead of sharp spikes, reflecting controlled fluctuations.
• The variation pattern shifts from steep changes to smoother transitions over time.
• This behavior indicates adaptive network response under moderate traffic conditions.

17.  RTT vs Time (Medium Traffic Condition - Index 145)

Inferences:-

• RTT stays near zero for the initial period, indicating minimal delay at the start.
• Small gradual increases appear early, showing progressive load impact.
• Mid-section shows irregular ups and downs, indicating inconsistent response times.
• A dominant spike occurs near the end, highlighting a sudden surge in delay.
• The spike is not preceded by steady growth, indicating abrupt network disturbance.
• RTT drops immediately after, showing quick recovery from the delay event.

18. RTT vs Packet Index (Medium Traffic using Scapy- Index 145)

Inferences:-

• RTT remains negligible for most packets, indicating consistent baseline performance.
• A very large spike dominates the graph, representing a significant delay event.
• The spike is isolated and not repeated, indicating a non-recurring anomaly.
• Other packets show minimal variation, suggesting stable communication otherwise.
• The graph highlights that single events can heavily influence RTT measurements.

19. Latency vs Time (High Traffic – Index 7)

Inferences:-

• Latency remains near zero for most of the duration, indicating idle or buffered intervals between bursts.
• Sudden sharp spikes are observed, showing abrupt congestion under high traffic load.
• A major peak at the end indicates severe delay due to heavy network usage.
• Spikes are more pronounced compared to medium traffic, reflecting higher instability.
• The delay pattern is irregular and bursty rather than smooth.
• Overall behavior indicates network stress under high traffic conditions.

20.RTT vs Time (High Traffic – Index 7)

Inferences:-

• RTT shows continuous small fluctuations, indicating constant variation in network response.
• Multiple moderate peaks are observed throughout, showing repeated delay events.
• No single dominant spike; instead, delay is distributed across the entire duration.
• RTT values rise and fall frequently, indicating unstable transmission under high load.
• The pattern suggests sustained congestion rather than isolated delay events.
• Overall behavior reflects high traffic causing persistent variation in response time.

21. Latency vs Packet Index (High Traffic using Scapy -Index 7)

Inferences:-

• Latency alternates sharply between high and low values, indicating rapid changes in delay.
• Peaks appear at multiple packet indices, showing repeated delay occurrences.
• Low values in between peaks indicate brief recovery periods.
• The pattern is highly irregular, reflecting unstable transmission under heavy load.
• Delay does not follow a smooth trend, indicating inconsistent packet handling.
• Overall behavior suggests high traffic causing frequent and abrupt latency shifts.

22. RTT vs Packet Index (High Traffic using Scapy - Index 7)

Inferences:-

• RTT increases progressively across initial packets, indicating growing delay accumulation.
• A maximum peak is reached, representing the highest round-trip delay under load.
• RTT drops abruptly after the peak, showing sudden recovery or packet clearance.
• Subsequent packets maintain very low RTT, indicating stabilized conditions.
• The sharp rise and fall indicate temporary congestion rather than sustained delay.
• Overall pattern reflects buildup of delay followed by rapid normalization. 

23. RTT vs Time (High Traffic – Index 41)

Inferences:-

• RTT varies continuously with no long stable region, indicating persistent network activity.
• Multiple medium-sized peaks are distributed across the timeline, showing repeated delay events.
• Unlike previous graphs, spikes are frequent but not extreme, indicating consistent moderate congestion.
• RTT oscillates rapidly, reflecting dynamic changes in network response time.
• No clear recovery phase is observed, suggesting ongoing load on the network.
• Overall pattern indicates sustained variability under high traffic conditions.

24. Latency vs Packet Index (High Traffic Using scapy  - Index 41)

Inferences:-

• Initial packets show very high latency spikes, indicating burst congestion at the start.
• Latency drops significantly after the initial phase, showing rapid stabilization.
• Middle portion remains mostly low with minor variations, indicating controlled transmission.
• Occasional spikes appear later, showing intermittent delay under load.
• The pattern transitions from heavy fluctuation to relatively steady behavior.
• Overall, high traffic impact is stronger at the beginning than in later packets.

25. RTT vs Packet Index (High Traffic Using scapy - Index 41)

 

Inferences:-

• RTT remains close to zero for most packets, indicating stable baseline response.
• A few distinct high spikes are observed at specific packet indices, showing isolated delay events.
• These spikes are spaced apart, indicating delays are not continuous but occur intermittently.
• The highest peak represents a significant round-trip delay under heavy load.
• Between spikes, RTT quickly returns to low values, showing immediate recovery.
• The pattern highlights sporadic but intense delay occurrences under high traffic.

New Findings :-

Latency behavior is not continuous; it occurs in bursts rather than gradual increase under high traffic.

Isolated extreme spikes dominate overall performance, even when most packets have low delay.

Network shows quick recovery after delay peaks, indicating efficient congestion handling.

Different patterns (zig-zag, clustered spikes, gradual rise) indicate multiple types of delay mechanisms.

High traffic does not always mean continuous delay; instead, it creates intermittent instability.

RTT and latency patterns differ, showing that forward delay and round-trip delay behave independently.

Recommendations :-

Implement burst control mechanisms to avoid sudden spikes.

Use QoS prioritization for critical packets.

Monitor for outlier spikes, not just average latency.

Optimize handling of transient congestion events.

The use of AI :-

Artificial Intelligence tools were utilized to enhance the efficiency and quality of this work. AI-assisted platforms helped in structuring the analysis, refining technical explanations, and generating clear interpretations of latency behavior from the observed graphs. Additionally, AI was used to improve the presentation of results, ensure consistency in documentation, and provide insights into network performance patterns. This enabled a more systematic and professional representation of the analysis while maintaining accuracy in understanding packet-level behavior.

Conclusion:-

The analysis demonstrates that latency behavior is highly dependent on traffic intensity and exhibits distinct patterns under varying network conditions. Under low traffic, latency remains stable with minimal fluctuations, while medium traffic introduces irregular variations and occasional delay spikes. High traffic conditions result in bursty and unpredictable latency patterns, characterized by sharp peaks and intermittent instability.

The study highlights that network delay is not always continuous but often occurs in isolated or clustered events, significantly influencing overall performance. Packet-level analysis using Wireshark and Scapy provides deeper insights into these variations, revealing patterns that are not evident through average metrics alone. The results emphasize the importance of monitoring transient delay spikes and managing traffic effectively to ensure reliable network performance.

Git hub repo link:-

https://github.com/Neha12052005/network-latency-analysis

YouTube Link:-

https://youtu.be/gvcLeO4X2cg?si=TNacfJmxWNN-pDJS

References:-

• Wireshark Official Website
  https://www.wireshark.org/
• Wireshark Documentation
  https://www.wireshark.org/docs/
• Scapy Documentation
  https://scapy.readthedocs.io/

Acknowledgement:-

I sincerely thank the School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology Chennai, for offering both theory and laboratory courses in Computer Networks during the Winter Semester 2025–2026 with an industry-standard syllabus.

I express my heartfelt gratitude to Dr. T. Subbulakshmi, Professor, SCOPE, VIT Chennai, for her valuable guidance, support, and encouragement throughout the course.

I would like to thank Gerald Combs, founder of Wireshark and recipient of the ACM Software System Award (2018), for developing an exceptional tool for network traffic analysis.

I would like to express my sincere thanks to my senior, Mr. Yash Kumar who is placed in a well-reputed company, for providing guidance and support during this work.

I would like to thank my peers, Mr. Shiddharth Rai and Ms. Suja Shivani S A, for their valuable suggestions and support throughout this work.

I express my heartfelt gratitude to my parents, siblings, and relatives for their constant encouragement, motivation, and support.

I acknowledge all other books, webpages, and individuals that contributed to my learning but may not have been explicitly mentioned here.

Author Name:-

Ms. Neha Khetan
II year B.Tech. CSE student
School of Computer Science and Engineering
VIT Chennai