?
Solved

How to interpret Wireshark statistics endpoints screen output.

Posted on 2011-09-22
2
Medium Priority
?
1,449 Views
Last Modified: 2012-06-27
If I run the statistics>endpoints on a trace I come up with Ethernet tab (6), IPv4 (19) and TCP (715)

It appears to me to mean that there are 6 mac addresses communicating on the spanned port, and those mac addresses are using 19 ip addresses and those 19 ip addresses are using using 715 ip and port combinations?

Is this correct or do I not understand correctly?
0
Comment
Question by:Dragon0x40
2 Comments
 
LVL 82

Accepted Solution

by:
arnold earned 1000 total points
ID: 36586824
It is partially incorrect.

Ethernet deals with MAC addresses seen.
IPv4 Deals with how many distinct IPs are seen (both local and remote, to and from traffic).
TCP deals with breaks down by the distinct on ip/port (i.e. you have 5 unique devices plus broadcast that are accessing 14 other unique IPs which at the time of the snapshot might mean that each of the 5 generated many web requests. While the destination ip/port remains the same, the source of the request changes. Sort by address in the tcp tab, and you will see that your local hosts will have multiple port references.)
0
 
LVL 21

Assisted Solution

by:Rick_O_Shay
Rick_O_Shay earned 1000 total points
ID: 36586880
It means that is what has been seen sending packets at the point you are capturing but remember you are going to see IP and port information for such things as broadcasts and multicasts etc. which are all going to be coming from the same switch or router MAC address.

Also every session the device is a part of will be another endpoint with the IP and TCP/UDP info of the remote partner device.
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question