Shannon Capacity Analysis Using Wireshark TCP Throughput Under Varying Traffic Loads
1. Introduction
Modern communication networks operate within hard theoretical boundaries defined by Claude Shannon's channel capacity theorem. Originally formulated in 1948, Shannon's theorem establishes the maximum rate at which information can be reliably transmitted over a noisy channel. For any real-world network, understanding the gap between this theoretical maximum and observed throughput is critical for diagnosing bottlenecks, optimising configurations, and planning capacity.
This experiment leverages Wireshark's TCP Stream Graph feature to visually measure TCP throughput across four distinct traffic intensity levels, then compares the resulting slope-based throughput values against the Shannon capacity ceiling of approximately 120 Mbps computed for the test environment. Traffic was generated using a single curl.exe command per level — downloading files of increasing size (10 MB, 100 MB, 1 GB, 10 GB) from a public speed-test server — while tshark simultaneously captured all packets into .pcap files for post-analysis in Wireshark.
The most significant finding is that TCP throughput was not limited by the Shannon channel capacity but by TCP receive window scaling behaviour. Once the OS scaled the TCP window from near-zero to 8 MB in the medium and high traffic captures, throughput immediately jumped to ~100 Mbps — reaching 83.3% of the Shannon ceiling. The channel had available capacity throughout; the transport layer was the sole bottleneck.
2. Objectives
- To compute the theoretical Shannon channel capacity (C = B · log₂(1 + S/N)) for the experimental network environment and establish it as an upper throughput bound for comparative analysis.
- To capture and analyse TCP stream graphs in Wireshark across four curl-generated traffic intensities (low, normal, medium, high) and extract throughput values by measuring the slope of the time-versus-bytes-transferred curve.
- To identify and explain the practical factors — including TCP receive window scaling, Bandwidth-Delay Product, and radio-layer SNR variation — that cause observed throughput to fall below the Shannon theoretical limit, and to recommend optimisations accordingly.
3. SharkFest Reference
Chappell, L. (2019). TCP Analysis Using Wireshark. Presented at SharkFest'19 US, Santa Clara, CA. Wireshark Developer and User Conference.
This SharkFest session by Laura Chappell is a foundational reference for TCP performance analysis using Wireshark. Chappell demonstrates how Wireshark's built-in TCP Stream Graphs — specifically the Time-Sequence (Stevens), Time-Sequence (tcptrace), Throughput, Window Scaling, and Round Trip Time views — can be used to diagnose real-world network problems. The session covers interpretation of the slope in throughput graphs as a direct measure of effective data transfer rate, explains the visual signatures of packet loss, retransmissions, and zero-window conditions, and introduces the concept of Bandwidth-Delay Product as a key limiting factor in long-fat network paths. The session also discusses TCP window scaling (RFC 7323) and SACK effects on observable throughput curves. This reference directly informed the five-graph-per-capture methodology used in this experiment to produce exactly 20 diagnostic observations.
4. Architecture Diagram
The following diagram shows the experimental topology. Two PowerShell windows ran simultaneously: Window 1 ran tshark to capture packets; Window 2 ran a single curl.exe command to generate traffic.
+------------------------------------------------------------------+
| TEST MACHINE (Client) |
| Windows 11 / PowerShell |
| |
| +---------------+ +----------------+ +------------------+ |
| | curl.exe |-->| NIC / TCP/IP |-->| Wireshark | |
| | (single HTTP | | Stack | | (post-capture | |
| | DL command) | +-------+--------+ | analysis) | |
| +---------------+ | +--------+---------+ |
| | raw pkts | |
| +---------------+ | v |
| | tshark.exe |<-----------+ TCP Stream Graphs: |
| | (Window 1, | Stevens / tcptrace |
| | captures) |---- saves --> Throughput |
| +---------------+ capture_X.pcap Window Scaling |
| Round Trip Time |
+------------------------------------------------------------------+
|
Mobile Hotspot
Bandwidth ~100 Mbps | SNR ~30 dB
|
v
+------------------------------+
| speedtest.tele2.net |
| 10 MB / 100 MB / 1 GB / |
| 10 GB files |
+------------------------------+
Shannon: C = 100 x log2(1 + 1000) = ~120 Mbps (theoretical ceiling)
Figure 1: Experimental topology — curl.exe generates single-command HTTP traffic, tshark captures into .pcap files, Wireshark TCP Stream Graphs extract throughput via slope measurement.
5. Procedure
5.1 Shannon Capacity Computation
Before running any captures, the theoretical channel ceiling was calculated:
SNR = 30 dB => linear SNR = 10^(30/10) = 1000
C = 100 x log2(1 + 1000)
= 100 x log2(1001)
= 100 x 9.967
= ~120 Mbps (Shannon ceiling used in all comparisons)
5.2 Traffic Generation Commands
Traffic was generated using one curl.exe HTTP download command per intensity level. File size was the control variable — larger files sustain higher throughput and produce richer graphs. This requires only a single command per capture.
| Traffic Level | curl.exe Command (Window 2) | File Size | Purpose |
|---|---|---|---|
| Low | curl.exe -o NUL http://speedtest.tele2.net/10MB.zip | 10 MB | Baseline, near-idle channel |
| Normal | curl.exe -o NUL http://speedtest.tele2.net/100MB.zip | 100 MB | Typical download workload |
| Medium | curl.exe -o NUL http://speedtest.tele2.net/1GB.zip | 1 GB | Sustained load, BDP saturation |
| High | curl.exe -o NUL http://speedtest.tele2.net/10GB.zip | 10 GB | Maximum stress, link saturation |
5.3 tshark Capture Commands
tshark was started in Window 1 first, then curl was immediately run in Window 2. For large files, curl was stopped with Ctrl+C after 2–3 minutes, then tshark was stopped.
## WINDOW 1 — start tshark FIRST # Run one of the following per session: tshark -i "Wi-Fi" -w C:\Users\palla\capture_low.pcap tshark -i "Wi-Fi" -w C:\Users\palla\capture_normal.pcap tshark -i "Wi-Fi" -w C:\Users\palla\capture_medium.pcap tshark -i "Wi-Fi" -w C:\Users\palla\capture_high.pcap ## WINDOW 2 — run curl immediately after starting tshark curl.exe -o NUL http://speedtest.tele2.net/10MB.zip # Low curl.exe -o NUL http://speedtest.tele2.net/100MB.zip # Normal curl.exe -o NUL http://speedtest.tele2.net/1GB.zip # Medium (Ctrl+C ~2 min) curl.exe -o NUL http://speedtest.tele2.net/10GB.zip # High (Ctrl+C ~3 min) ## Stop order: Ctrl+C Window 2 first, then Ctrl+C Window 1
5.4 Wireshark Analysis Method
Each .pcap was opened in Wireshark. A TCP stream was selected via right-click → Follow → TCP Stream, then five graph types were opened under Statistics → TCP Stream Graphs: Stevens, tcptrace, Throughput, Window Scaling, and Round Trip Time. Throughput slope was measured as ΔBytes × 8 / Δtime(s) in the steady-state region.
6. Graph Inferences (20 Observations)
Formulae used throughout: Slope (Mbps) = ΔBytes × 8 / Δt(s) / 106 BDP = Throughput(B/s) × RTT(s) Shannon ceiling = 120 Mbps
7. New Findings & Recommendations
Key Findings
- TCP window scaling — not bandwidth — is the dominant throughput bottleneck: In both medium and high captures, throughput was near-zero for 120–300 seconds not because the channel lacked capacity, but because the TCP receive window was too small. The window scaling event (Graph 13: 0 → 8 MB) caused an immediate jump from near-zero to ~100 Mbps, proving the channel had capacity throughout the entire transfer.
- Peak observed = 100 Mbps = 83.3% of Shannon limit; gap is structural at ~20 Mbps: The consistent 20 Mbps gap across both medium and high captures is attributable to TCP/IP header overhead (~3.5%), upstream ACK traffic (~2%), and throughput graph MA smoothing (~11%). It is not caused by congestion or retransmissions, as confirmed by the near-clean tcptrace graphs.
- Normal traffic shows how mobile SNR variation directly reduces Shannon capacity: The 2.3-second RTT spikes in normal.pcap indicate the effective channel SNR dropped severely. Shannon's formula shows lower SNR directly lowers C — here, practical capacity fell to 0.072 Mbps due to radio interference while the theoretical ceiling remained 120 Mbps.
- Low traffic BDP = 100 KB at 800 ms RTT spike > 64 KB default window → stall: This created a BDP bottleneck at minimal load due purely to radio scheduling latency, demonstrating that even very low throughput can be window-limited in mobile environments with high intermittent RTT.
- Shannon's ceiling validated empirically across all 20 graphs: No measurement in any of the 20 Wireshark graphs exceeded 120 Mbps, confirming Shannon's capacity theorem as an empirical fact, not just a theoretical construct.
Recommendations
- Force early TCP window scaling: Configure the OS to advertise a large initial receive window (e.g., 4 MB) at handshake time to eliminate the 120–300 second dead zone seen in medium and high captures.
- Deploy FQ-CoDel AQM on the hotspot router: The 800 ms RTT spikes in low traffic and 2.3-second spikes in normal traffic indicate poor buffer management. FQ-CoDel would cap queuing delay to ~5 ms, preventing BDP inflation and window stalls.
- Switch to BBR congestion control: BBR probes bandwidth and RTT directly rather than reacting to loss. It would detect available capacity much earlier than the 120–300 second slow-start observed with default CUBIC.
- Monitor actual SNR alongside captures: Use
netsh wlan show interfacesto log SNR at capture time, allowing Shannon capacity to be computed dynamically for more precise comparisons.
8. AI Usage Disclosure
Perplexity AI was used for the following purposes:
- Clarifying the mathematical derivation of the Shannon-Hartley theorem and SNR dB-to-linear conversion.
- Identifying the SharkFest reference for TCP stream graph methodology.
- Cross-checking the relationship between TCP window scaling (RFC 7323) and the Bandwidth-Delay Product constraint.
All experimental commands, pcap captures, graph readings, slope calculations, and conclusions are original work. AI assistance was limited to conceptual clarification only.
9. Conclusion
This experiment empirically validated Shannon's channel capacity theorem across four traffic conditions using Wireshark TCP Stream Graphs. The Shannon ceiling was computed as C = 100 × log₂(1 + 1000) ≈ 120 Mbps. Across all 20 graphs from four pcap captures, this ceiling was never breached.
The most significant finding was that throughput was limited by TCP receive window scaling, not by bandwidth. In medium and high captures, throughput ran near-zero for 120–300 seconds before the OS scaled the window to 4–8 MB, at which point throughput jumped immediately to ~100 Mbps (83.3% of Shannon's ceiling). The channel had available capacity throughout; the transport layer was the sole bottleneck.
| Capture | Avg Slope | Peak | Shannon % | Primary Bottleneck |
|---|---|---|---|---|
| low.pcap | 0.93 Mbps | 2.5 Mbps | 0.78% / 2.1% | TCP slow-start + radio RTT spikes (800 ms) |
| normal.pcap | 0.072 Mbps | 200 kbps | 0.06% / 0.17% | Packet loss, RTO events, radio interference (RTT 2.3 s) |
| med.pcap | 17.9 Mbps | ~100 Mbps | 14.9% / 83.3% | TCP window too small for first 120 s; scaling resolved it |
| cap_high.pcap | 11.6 Mbps | ~100 Mbps | 9.7% / 83.3% | TCP window too small for first 300 s; scaling resolved it |
The consistent 20 Mbps gap between observed peak and Shannon ceiling is a structural protocol overhead (~16.7%), confirmed as non-congestion-related by near-clean tcptrace graphs. Shannon's theorem is validated as an absolute empirical bound.
10. Demo Video
A walkthrough of the tshark captures, Wireshark TCP Stream Graphs, and slope readings is available on YouTube:
11. GitHub Repository
All .pcap files, tshark commands, graph screenshots, and this report are available at:
References
- Shannon, C. E. (1948). A mathematical theory of communication. Bell System Technical Journal, 27(3), 379–423.
- Chappell, L. (2019). TCP Analysis Using Wireshark. SharkFest'19 US. Wireshark Foundation.
- Jacobson, V., & Karels, M. (1988). Congestion avoidance and control. ACM SIGCOMM, 18(4), 314–329.
- Borman, D., Braden, B., Jacobson, V., & Scheffenegger, R. (2014). TCP Extensions for High Performance. RFC 7323. IETF.
- Cardwell, N. et al. (2016). BBR: Congestion-based congestion control. ACM Queue, 14(5), 20–53.
- Gettys, J., & Nichols, K. (2012). Bufferbloat: Dark buffers in the internet. Comm. of the ACM, 55(1), 57–65.
- Wireshark Foundation. (2024). Wireshark User's Guide v4.x. https://www.wireshark.org/docs/wsug_html_chunked/
- Tele2 AB. (2024). Tele2 Speed Test Files. http://speedtest.tele2.net/
Acknowledgements
I sincerely thank my parents and family for their constant support and encouragement throughout my academic journey at VIT. Their patience and motivation during late-night lab sessions made this work possible.
I am deeply grateful to Vellore Institute of Technology (VIT), Chennai — specifically the School of Computer Science and Engineering (SCOPE) — for providing the infrastructure, laboratory resources, and academic environment that enabled this experiment.
This Digital Assignment (DA3) was completed as part of the course BCSE308L & Computer Networks during Winter Semester 2025–26. I sincerely thank my course faculty for designing this hands-on activity in network analysis and information theory.
I also acknowledge the open-source communities behind Wireshark, tshark, and the SharkFest conference for making world-class network analysis tools and educational resources freely available.
Finally, I thank my peers for their time in reviewing this blog and providing the technical comments below.
Tech Comments — Peer Reviews
Good demonstration.
Clarity of inferences, good demonstration.
Additional tech comments are visible in the Blogger comments section below and in the YouTube video comments.
Comments
Post a Comment