ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 1885] "Protocol Hierarchy Statistics" give misleading byte

Date: Wed, 09 Mar 2016 19:07:10 +0000

Comment # 4 on bug 1885 from
(In reply to Gerrit Code Review from comment #3)
> Change 14392 merged by Michael Mann:
> Use field info length instead of packet length for protocol hierarchy stats.
> 
> https://code.wireshark.org/review/14392

Judging by the results, this looks like the wrong approach to me.

For example, previously statistics showed something like this:

Protocol             % Packets    Packets    % Bytes   Bytes
- Frame             100.00%      40         100.00%   3660
  - Ethernet         100.00%      40         100.00%   3660
    - IPv4           100.00%      40         100.00%   3660
      - TCP          100.00%      40         100.00%   3660

... but now it shows this:
Protocol             % Packets    Packets    % Bytes   Bytes
- Frame             100.00%      40         100.00%   3660
  - Ethernet         100.00%      40          15.30%    560
    - IPv4           100.00%      40          21.86%    800
      - TCP          100.00%      40          62.84%   2300

What it ought to show is this:
Protocol             % Packets    Packets    % Bytes   Bytes
- Frame             100.00%      40         100.00%   3660
  - Ethernet         100.00%      40         100.00%   3660*
    - IPv4           100.00%      40          84.70%   3100**
      - TCP          100.00%      40          62.84%   2300

*All the data is Ethernet data
**3100 calculated from 3660 - (40 * 14): All the data is IPv4 data except for
the 14 bytes of Ethernet overhead per packet (there are no trailing Ethernet
FCS bytes in this case)

We should always see numbers grow consistently smaller as each protocol's
overhead is excluded from the statistics of the next layer.


You are receiving this mail because:
  • You are the assignee for the bug.
  • You are watching all bug changes.