On Mon, Oct 08, 2001 at 05:31:02PM +0000, Surena K.D. wrote:
> In the summay page, I summed up the percents (or packets) under the TCP
> section,
To which summary page are you referring?
The one that pops up if you select "Summary" from the "Tools" menu
doesn't give counts of packets of particular types.
The one that pops up if you select "Protocol Hierarchy Statistics" from
the "Tools" menu does. Is that the summary to which you're referring?
> and they did not equal the percent (or total number of packets) of
> TCP. What causes this diffrence?
Assuming you're referring to the "Protocol Hierarchy Statistics" window,
a couple of things could cause it:
1) TCP packets that contain no data (e.g., ACK-only packets, or
the initial or final 3-way handshake packets if they contain
no data) are not classified by the protocol running on the
connection, so they will not show up in items under the item
for TCP, even though they will show up in the item for TCP;
2) TCP packets that contain data for a protocol that Ethereal
doesn't dissect also won't be classified by the protocol
running on the connection, as Ethereal doesn't know that
protocol.
