HTTP and HTTPS Response in wireshark

Question

Can I measure the response time for the http/https website using the wireshark packet. most of the website/blog only show how to check http response time only, if I want to know the HTTPS response time, how is it?thank you.

Answer 1

Configure Wireshark to decrypt SSL, and then measure the response time as with HTTP (ie, by subtracting the packet times). One easy way to decrypt SSL traffic is to configure your browser to save pre-master secrets to a log file and configuring Wireshark to look for secrets in that log file. As an example, to configure Chrome, you set the environment variable SSLKEYLOGFILE to the full path of the log file and restart any Chrome processes (including background processes). Then in Wireshark, open Preferences >> Protocols >> SSL and point the Pre-Master-Secret log at the same file. There is a more detailed walk through at: https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/

To get the response time, find a packet from the request/response conversation. Some of those packets should be highlighted in green with a protocol of "HTTP" if it was successfully decrypted. Right click on one of the packets and select "Follow >> SSL Stream". This should filter all the packets in the main window, limiting them to the TCP stream of interest. From there, you can scroll to find the last packet from the request, the first packet from the response, and the last packet from the response. Then, depending on what you mean by response time, just subtract the two times which cover that. For example, if you want the time from when the request was sent to the time when the response started, just subtract the time of the last request packet from the time of the first response packet.

You should also be able to use the other websites you referred to in your question to get the response timing. The process is essentially the same once you have the SSL stream decrypted.