• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 384
  • Last Modified:

wireshark conversation statistics

I got the conversation statistics (see pic). There are 202 IP conversations, 416 tcp conversations, and 1043 udp conversations. I thought that tcp and udp are under IP. That is what showing under Protocol Hierarchy statistics. But looking at the conversations, the sum of conversations of tcp and udp are greater than IP conversations. Am I missing something? Thanks

pic
0
leblanc
Asked:
leblanc
  • 3
  • 3
2 Solutions
 
UnHeardOfCommented:
if you look at the TCP/UDP tabs you will notice that you may have multiple connections ( conversations ) to the same host.
0
 
leblancAccountingAuthor Commented:
Ahhh.. That makes sense.

My duration is 160.034 for the conversation. How do I find out the unit set for the duration. I was thinking ms but I just want to confirm it. Thx
0
 
UnHeardOfCommented:
The help documenation regarding the fields for the Conversations is based on seconds. I know you can change the time format on the actual capture itself by going to view > Time Display Format.

Conversation Help Contents

8.4.2. The "Conversations" window
The conversations window is similar to the endpoint Window; see Section 8.5.2, “The "Endpoints" window” for a description of their common features. Along with addresses, packet counters, and byte counters the conversation window adds four columns: the time in seconds between the start of the capture and the start of the conversation ("Rel Start"), the duration of the conversation in seconds, and the average bits (not bytes) per second in each direction.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
leblancAccountingAuthor Commented:
Yes. I see it now. That is interesting because my total capture time is 12 minutes and I just saw some duration that is around 660.00. I don't think it is in seconds because it would last longer than my capture time. I don't think I changed the duration in the past because I don't know how. So this must be ms somehow.
0
 
UnHeardOfCommented:
12 minutes is 720 seconds. So that could be accurate and in seconds.
0
 
leblancAccountingAuthor Commented:
Yes you are correct. I just realized that I made a mistake in my calculation. Thx
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now