TOTAL
Since dec 2006
1'942'871 Visitors
4'218'042 Pages

Nov 2010 Stats
82'909 Visitors
146'476 Pages
196 countries
Full statistics



Help us translate
our tutorials!

JOIN the
OpenManiak Team.
OM TEAM
Director:
Blaise Carrera
Tutorials creation:
Blaise Carrera
Translaters:
Giovanni Fredducci
Angel Chraniotis
Moham. H. Karvan
Alexandro Silva
Blaise Carrera
Andrei Chertolyas
Sergiy Uvarov
Nickola Kolev
Łukasz Nowatkowski
Ivo Raisr
Catalin Bivolaru
Bogdan A. Costea
Kirill Simonov
Oliver Mucafir
JaeYoung Jeon
Seungyoon Lee
Jie Yu & Si Cheng
Tao Wei
YukiAlex
Fumihito Yoshida
Muhammad Takdir
Çağdaş Tülek
Auditors
Leslie Luthi
Joe Anderson
Jennifer Ockwell
Nigel Titley
Alison Rees
Sabrina Barbey
Webmaster:
Blaise Carrera
WIRESHARK - The Easy Tutorial - Statistics

Wireshark Statistics
Last update: 10-12-2010




Tool
Tutorial
Ergonomy
Forum



Details What is Wireshark?
Screenshots
Prerequisites
Installation
Launch Wireshark
Platform
Filters
Statistics




If you like our tutorials, don't hesitate to support us and visit our sponsors!
Si vous aimez nos tutoriaux, n'hésitez pas à nous supporter et visiter nos sponsors!



Wireshark provides a lot of different statistics which can be consulted if you click on the "statistics" field on the top of the screen.

We will present below, some statistics examples:







Summary

Protocol Hierarchy

Conversations

Endpoints

IO Graphs


Conversation List

Endpoint List

Service Response Time






 
wireshark statistics

 
RTP

SIP
VoIP Calls


 
Destinations
Flow Graph
HTTP
IP address



Packet Length
Port Type
 



Summary

Basic global statistics are available in the summary window such as:
- Capture file properties
- Capture time
- Capture filter information.
- Display filter information.

wireshark statistics summary

Top of the page



Protocol Hierarchy

The protocol hierarchy shows a dissection per OSI layer of the displayed data.

wireshark statistics protocol hierarchy

Top of the page



Conversations

If you use TCP/IP suite application or protocol, you should find four active tabs for Ethernet, IP, TCP and UDP conversations. A "conversation" represents the traffic between two hosts.
The number in the tab after the protocol indicates the number of conversations. For instance: "Ethernet:6".

Ethernet conversations:

wireshark statistics conversations ethernet

IP conversations:

wireshark statistics conversations ip

TCP conversations:

wireshark statistics conversations tcp

UDP conversations:

wireshark statistics conversations udp

Top of the page



Endpoints

The endpoints provide statistics about received and transmitted data on a per machine base.
The number after the protocol indicates the number of endpoints. For instance: "Ethernet:6".

Ethernet endpoints:

wireshark statistics endpoints ethernet

IP endpoints:

wireshark statistics endpoints ip

TCP endpoints:

wireshark statistics endpoints tcp

UDP endpoints:

wireshark statistics endpoints udp

Top of the page



IO Graphs

Basic graphics can be obtained under the "IO graphs" section.
Multiple graphics can be added in the same window on a per display filter base.
In our example below, we chose to draw two graphs depending on a "tcp" and "http" display filter.

wireshark io graphs

Top of the page



Conversation List

The "Conversation List" section provides the same information as the one given by the "Conversations" section.

Top of the page



Endpoint List

The "Endpoint list" section provides the same information as the one given by the "Endpoints" section.

Top of the page



Service Response Time

13 protocols are available for an in-depth inspection.
In our example we chose SMB (Server Message Block) which runs on top of the NetBIOS protocol (see Protocol Hierarchy screenshot) and is typically used when files are shared on a Local Microsoft Windows environment.

wireshark service response time

The Wireshark display filter is shown in the smb filter field.
In our example, we have no display filter.

wireshark service response time

wireshark service response time

Top of the page




RTP

RTP (Real-time Transport Protocol, RFC 3550) is a protocol for carrying voice and video communications over an IP network. It runs on the top of the User Datagram Protocol. (UDP)
It is frequently used in conjunction with SIP or H.323 which provide the signaling tasks.

Show all streams

wireshark RTP all streams

wireshark RTP all streams

Stream analysis

wireshark RTP stream analysis

wireshark RTP analysis stream



Top of the page



SIP

SIP (Session Initiation Protocol, RFC 3261) is a signaling protocol for establishing VoIP or video sessions.
It works typically with the RTP protocol which is used to transmit multimedia data.

wireshark SIP



Top of the page



VoIP Calls

VoIP (Voice over IP) generally uses two types of protocols:
- signaling protocols such as SIP or H.323
- carrying protocols such as RTP

wireshark RTP stream analysis

wireshark voip calls

Top of the page



Destinations

The "Destinations" section shows all the destination IP addresses of the network packets.

wireshark filter

wireshark destinations

Top of the page



Flow Graph

The "Flow Graph" section provides a sequential analysis of TCP connections.
In our example, we created a displayed filter to target only traffic to the openmaniak.com website.

wireshark flow graph

The three first lines show a TCP connection establishment with the "SYN", "SYN ACK" and "ACK" sequences.

wireshark flow graph filter


Top of the page




HTTP

HTTP (Hypertext Transfer Protocol) is a client-server communication protocol used to transfer HTML files.
An HTTP client, most of the time a web browser, sends an HTTP request to a web server with the well-known "URL" field to locate the file. The web server will answer with an HTTP response and provides to the client the desired web page.

Three sub-sections are available under "HTTP":
- Load Distribution
- Packet Counter
- Requests

Load distribution:

wireshark http

In our example, we created a displayed filter to target only trafic to the openmaniak.com website.

wireshark http filter

wireshark load distribution

Packet Counter:

Display the HTTP requests and responses.

wireshark http packet counter

In our example, we created a displayed filter to target only traffic to the openmaniak.com website.

wireshark http filter

wireshark http packet counter

Requests:

Display the files consulted on the web server.

wireshark http requests

In our example, we created a displayed filter to target only traffic to the openmaniak.com website.

wireshark http filter

wireshark http requests

Top of the page



IP address

Display the source or destination IP address of the network packets.

wireshark filter

wireshark ip address

Top of the page



Packet Length

wireshark filter

wireshark packet length

Top of the page



Port Type

Display TCP or UDP ports statistics.

wireshark filter

wireshark port type

Top of the page





If you liked our tutorials, don't hesitate to support us and visit our sponsors!
Si vous aimez nos tutoriaux, n'hésitez pas à nous supporter et visiter nos sponsors!