This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

i have a pcap file to analyse and i want to find out which ip sent the biggest amount of data .. what is the steps?

asked 27 Mar '17, 14:34

seeker's gravatar image

seeker
11113
accept rate: 0%


Use the Statistics menu to look at the Endpoint statistic, and select the IP tab.

permanent link

answered 27 Mar '17, 14:35

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

i found tabs named (Bytes A-> B) and (Bytes B->A) each tab carries a different size number, what is the difference between them?

(27 Mar '17, 14:40) seeker

I think you went to "Conversations" instead of "Endpoints", which lists two IPs talking to each other (A and B). In the endpoint statistic, there is no A and B :-)

(27 Mar '17, 14:42) Jasper ♦♦

in "Endpoints" there is two IPs in two separated lines, the first line the first IP sent 100 from A to B and sent 50 from B to A, the second line the second IP sent 50 from A to B and sent 100 from B to A (the reversed statics from line 1), does that mean the first IP sent the biggest amount "100"?

(27 Mar '17, 14:54) seeker

Yes, you're right, I didn't notice, those column labels are misleading in version 2.x (I think they're plain wrong, tbh) - they should read "Tx Packets", "Tx Bytes", "RX Packets", "Rx Bytes", with "Tx" = "Transmitted" and "Rx" = "Received", as they were in version 1.x

(27 Mar '17, 14:59) Jasper ♦♦

thanks a lot, i should they are plain wrong too with Tx and Rx it became easier :-)

(27 Mar '17, 15:04) seeker

I added a bug report to the bugtracker here: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13526

(27 Mar '17, 15:07) Jasper ♦♦

And... it's fixed, in the lastest dev builds:

https://www.wireshark.org/download/automated/

(28 Mar '17, 12:35) Jasper ♦♦
showing 5 of 7 show 2 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×122

question asked: 27 Mar '17, 14:34

question was seen: 1,572 times

last updated: 28 Mar '17, 12:35

p​o​w​e​r​e​d by O​S​Q​A