Ask Your Question
0

Protocol Hierarchy seem Ethernet bytes less than LLC bytes

asked 2022-10-13 02:08:47 +0000

thinostrich gravatar image

updated 2022-10-13 03:11:32 +0000

Guy Harris gravatar image

count with packets it seem ok, Ehternet packects is 100%, but count with bytes it make me confusion. why Ethernet bytes is not 100%?

protocol                packets percent packets num bytes percent   bytes
Frame                   100             418793  100                 25848498
Ethernet                100             418793  22.68256361         5863102
Logical-Link Control    99.85338819     418179  58.8855337          15221026
Spanning Tree Protocol  61.73503378     258542  25.00551483         6463550
Data                    38.11835441     159637  25.93865996         6704754
edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-10-13 03:26:37 +0000

cmaynard gravatar image

The reason the percent bytes isn't 100% Ethernet even though the percent packets is 100% Ethernet is because the statistics is only counting the Ethernet framing bytes as being Ethernet bytes, but not the Ethernet payload bytes.

Personally, I've never liked the way Wireshark computes these statistics, but that's the way Wireshark has behaved for the last 6+ years.

For more information and background, refer to Issue 1885: "Protocol Hierarchy Statistics" give misleading byte numbers.

edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2022-10-13 02:08:47 +0000

Seen: 76 times

Last updated: Oct 13 '22