This is our old Q&A Site. Please post any new questions and answers at

Hi, I have an application, that I would like to check if is using bidirectional traffic. Is possible to check these with wireshark? Thanks and sorry for my English!

asked 16 Jun '16, 09:30

absolut's gravatar image

accept rate: 0%

Yes, you can see bidirectional traffic in Wireshark.

permanent link

answered 16 Jun '16, 09:46

Amato_C's gravatar image

accept rate: 14%

Thanks... but how could I can identificate?

(16 Jun '16, 09:56) absolut

Wireshark will show ingress/egress traffic to/from the capture point. Look at the Source address. Ingress traffic will have the Source address as the capture point. Egress traffic will have a different source address.

(16 Jun '16, 12:45) Amato_C

Sorry I understand that the bi-directional communication always begin by source ip to destination ip, and communicates by the same port. So if I see like these:

12335   1642.502395000   GIOP    165 GIOP 1.2 Request, s=99 id=84: op=CRB_ClientKeepAlive\000
12336   1642.502785000   GIOP    82  GIOP 1.2 Reply, s=16 id=84: No Exception
12337   1642.657680000   TCP 54  1093→38960 [ACK] Seq=5906 Ack=13916 Win=64557 Len=0

It seems that is not bi-directional no? thanks!

(16 Jun '16, 14:03) absolut

It is bidirectional. The port numbers the participants use are independent of each other and tshark doesn't show them by default.

So one participant uses IP address x.x.x.x port XXXX and the other one uses IP address y.y.y.y port YYYY. One direction of the communication is then x.x.x.x:XXXX -> y.y.y.y:YYYY, the other direction is y.y.y.y:YYYY -> x.x.x.x:XXXX.

Besides, tshark shows the name of the highest-level protocol it could find in the frame. So if a transport protocol (TCP in your case) is used to convey PDUs of an application protocol (GIOP in your case), the frames which carry any GIOP as TCP's payload are marked as GIOP ones; the frames belonging to the same TCP session but carrying only TCP's overhead are marked as TCP ones (frame 12337 in your example).

(16 Jun '16, 14:30) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 16 Jun '16, 09:30

question was seen: 2,899 times

last updated: 16 Jun '16, 14:30

p​o​w​e​r​e​d by O​S​Q​A