Revision history [back]

@paulofford is definitely the authority here, but as far as I can tell, the client is the side that initiates the connection, the service is the side offering the service to which the client connects, and intermediate is somewhere in between the two. So, it's my understanding that your assumption is correct, that a capture from the load balancer would be considered as intermediate.

You might want to also have a look at Paul's [Transum presentation] (https://sharkfestus.wireshark.org/assets/presentations15/33.pdf) from the 2015 Sharkfest Conference. There is also a Wireshark Transum wiki page, but unfortunately there's not much more information there, and the link to the Transum User Guide is now broken because tribelab no longer exists, presumably shut down as part of Advance7 being taken over by Northern Trust.

@paulofford is definitely the authority here, but as far as I can tell, the client is the side that initiates the connection, the service is the side offering the service to which the client connects, and intermediate is somewhere in between the two. So, it's my understanding that your assumption is correct, that a capture from the load balancer would be considered as intermediate.

You might want to also have a look at Paul's [Transum presentation] Transum presentation (https://sharkfestus.wireshark.org/assets/presentations15/33.pdf) from the 2015 Sharkfest Conference. There is also a Wireshark Transum wiki page, but unfortunately there's not much more information there, and the link to the Transum User Guide is now broken because tribelab no longer exists, presumably shut down as part of Advance7 being taken over by Northern Trust.