This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi there,

I´m pretty new to Wireshark. So maybe you can answer me a question about sniffing my LAN.

Is there a possibility to see which IP address is using a high level of bandwidth? The best thing would be a new column in the capture pane, like MBit/s. I didn´t find anything in the wiki, so maybe you know even if it´s possible.

I was thinking of something like this:

No. Time Source Destination [Usage in MBit/s] Information ^ | This would be my new column.

I´m not a native english speaker, so my English is poor. Hopefully you understand what I´m trying ti do.

Kind regards Martin

asked 07 Dec '11, 07:23

Martin's gravatar image

Martin
6112
accept rate: 0%


Go for statistics -> conversations and there you check the tab labeled "IPv4". The two rightmost coloumns give you bits per second in each direction between those IP addresses. If you want to have them sorted, simply click on the coloumn's label.

permanent link

answered 07 Dec '11, 07:30

Landi's gravatar image

Landi
2.3k51442
accept rate: 28%

Hi Landi,

thanks for your quick reply.

Is there any way I can personalize the capture pane the way I wanted to do?

I found this option on my own, but it´s not exactly what I was looking for.

Kind regards Martin

(07 Dec '11, 07:43) Martin
1

Sorry, but wireshark treats the packets independently in the packet list -> what you would need is a custom column that supports math operations like ((cumulative bytes / relative time) * 8 / 10^6)

So either you export your trace to e.g. excel and do it there or like already suggested you go for statistics, which IMO is perfectly fine for your needs because of the ability to directly sort for the top talkers

(08 Dec '11, 03:31) Landi

Thanks Landi for your support.

I´m going to use statistics to find the top talkers.

Topic may be closed.

Kind regards Martin

(09 Dec '11, 00:12) Martin

Martin, I converted your answer to a comment, as that's the way this site works best, please see the FAQ. Regarding "closing" this topic, you can do that by "accepting" the answer that answered your question best (duh, there is only one answer this time) by clicking on the checkmark (little 'v') next to it.

(09 Dec '11, 00:35) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×19

question asked: 07 Dec '11, 07:23

question was seen: 33,728 times

last updated: 09 Dec '11, 00:35

p​o​w​e​r​e​d by O​S​Q​A