Plain Apache vs. Moodle

Below are two input/output (IO) graphs created by a Wireshark packet trace. The first is a file downloaded from a web server program called Moodle, which is the software our “Scholar” site runs and serves out class information. The second is a packet trace of a download from a, which only runs through Apache. The websites are on different machines, but in the same room.



I created the graphs as part of my notes for CIS 340 Networking. I was surprised at the difference between the downloads.

3/25/2014: Followup

In class, we were guessing the difference had to do with server load, encryption, or the overhead of the Moodle software. We didn’t have an easy way to find out for certain.

Thankfully, one of our networking engineers was willing to work with me and try and figure out what the difference was. Demonstrating the transient nature of these types of problems, I wasn’t able to recreate the slow throughput at all.

Below is a capture with the plain web server.


Below is the same web server, but encrypted.


Below is the same encrypted web server, but using Moodle.


In each case, the traces look about the same. This means that encryption and the Moodle software by themselves will not cause this slow down.

Perhaps back when the original tests were done trace the server had a high CPU or I/O load. Unfortunately there isn’t any way to know for certain without being able to reproduce the results.