Wireshark · Ethereal-users: [Ethereal-users] [Fwd: Ethereal statistics reporting]

[Alex <alexle4@xxxxxxxxxxx>]

Hi,
I am looking for a response, please.

Have to know what packets go to what bucket. How a decision is made 
which packets go where?

When stats (conversations) are ran what packets end up on the IP tab? 
Are IP - ESP packets counted to this tab?  What if  there is TCP below 
ESP  - where these packets end up?

Appreciate your help very much !!

-Alex

--- Begin Message ---

From: Alex <alexle4@xxxxxxxxxxx>

Date: Tue, 14 Jun 2005 11:23:51 -0700

Hi,
Sorry if am asking a question, which is in the docs, but I did not find.

Suppose I am capturing a traffic mix - clear text and IPSec with ESP (no encryption), but TCP header is shifted back.

How TCP statistics are reported in this case?

Manual says: *"TCP* a TCP endpoint is a combination of the IP address and the TCP port used, so different TCP ports on the same IP address are different TCP endpoints."

My guess is that Ethereal does not see ports and cannot not recognize TCP as TCP. It reads it as ESP....but actually it is a TCP packet.

Basically the bigger question is "what to trust" and "what not to trust" on stats? What stats screen is actually shows? I am wondering if my ESP traffic even counted...

Thanks much,
-Alex

--- End Message ---