Wireshark · Ethereal-dev: Re: [Ethereal-dev] Flow graph functionality

[Alejandro Vaquero <alejandrovaquero@xxxxxxxxx>]

Guy Harris wrote:

> Alejandro Vaquero wrote:
>
> > I'll fix this. But in this case the Graph will not show the flow 
> > because both IPs are the same, and the flow only displays one column 
> > per IP (not per port). Maybe an enhancement will be to use also the 
> > port when both IPs are the same?
>
>
> If you're talking about transport-layer flows, the address and port on 
> both sides should presumably always be used, as they identify a 
> transport-layer endpoint.  (For higher-level sessions, you might have 
> more than one transport-layer flow, e.g. call setup and the call 
> itself, or mount/NFS/lock manager traffic, or....)

For the "VoipCalls" I uses just the IP because, as you said, there are 
different transport-layer involved in a single call. For example and 
H323 call you have a UDP and TCP connection (sometimes two TCP if H245 
is not tunneled) and multiple UDP connections for the RTP.

> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev