This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Packet Analyzer - PE Value for Wireshark Users

0

Hi all, I was checking the PA-PE option to integrate to Wireshark, and got the trial evaluation. First I would thank Riverbed to sustain the wordeful job done here , so my question is a genuine need for understanding . I got the trial and was thinking to get the subscription exposed here on the web, , but at a first look, I was really not able to understand the added value it should add to wireshark. I see some good dashboard , but cannot find something 'you cannot miss' or is not better detailed in wireshark. If someone could explain the use case for such an integration , I would be grateful. My eyes say more scapy after wireshark than PA-PE , so I am probably missing something . Thanks in Advance Fabio D'Alfonso

asked 12 Mar '16, 07:12

fabio_dalfonso's gravatar image

fabio_dalfonso
6224
accept rate: 0%


One Answer:

0

From my point of view it is a very good add-on to wireshark:

  • It can be used for mass data analysis
  • It has a great wireshark integration
  • Nice report functions
  • The analysis is more graphical based, but I like it, when it comes to mass analysis
  • You should have an expectation, if you want to analyze mass data

From my point of view Wireshark is mostly better, when you just need to analyze one single session.

answered 12 Mar '16, 07:43

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 12 Mar '16, 08:19

agreed, PA is intended to help with drilling down into massive amounts of packet data, not just a couple of sessions.

(12 Mar '16, 07:54) Jasper ♦♦

Thanks, I will try to focus on pa-pe using the trial period to get a better idea of functionality and cases of use. From what you both told, it seems something that could be better used to get a the big picture. But details are still got in wireshark. I will probably get a better idea when against some large traffic scenario. At the moment I still cannot see a free / 690$ balance , with their respective parts in the job. Obviously 29 / year is a coin , but I reported the license fee just to give another shot at the question starting this post.

The feeling was that when you have the top, imagine the paid will be the TOP.

(12 Mar '16, 09:28) fabio_dalfonso