i have a pcap file to analyse and i want to find out which ip sent the biggest amount of data .. what is the steps? asked 27 Mar '17, 14:34  seeker |
One Answer:
Use the Statistics menu to look at the Endpoint statistic, and select the IP tab. answered 27 Mar '17, 14:35  Jasper ♦♦ showing 5 of 7 show 2 more comments |
i found tabs named (Bytes A-> B) and (Bytes B->A) each tab carries a different size number, what is the difference between them?
I think you went to "Conversations" instead of "Endpoints", which lists two IPs talking to each other (A and B). In the endpoint statistic, there is no A and B :-)
in "Endpoints" there is two IPs in two separated lines, the first line the first IP sent 100 from A to B and sent 50 from B to A, the second line the second IP sent 50 from A to B and sent 100 from B to A (the reversed statics from line 1), does that mean the first IP sent the biggest amount "100"?
Yes, you're right, I didn't notice, those column labels are misleading in version 2.x (I think they're plain wrong, tbh) - they should read "Tx Packets", "Tx Bytes", "RX Packets", "Rx Bytes", with "Tx" = "Transmitted" and "Rx" = "Received", as they were in version 1.x
thanks a lot, i should they are plain wrong too with Tx and Rx it became easier :-)
I added a bug report to the bugtracker here: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13526
And... it's fixed, in the lastest dev builds:
https://www.wireshark.org/download/automated/