Protocol Hierarchy seem Ethernet bytes less than LLC bytes

asked 2022-10-13 02:08:47 +0000

updated 2022-10-13 03:11:32 +0000

Guy Harris
19890 ●3 ●634 ●207

count with packets it seem ok, Ehternet packects is 100%, but count with bytes it make me confusion. why Ethernet bytes is not 100%?

protocol                packets percent packets num bytes percent   bytes
Frame                   100             418793  100                 25848498
Ethernet                100             418793  22.68256361         5863102
Logical-Link Control    99.85338819     418179  58.8855337          15221026
Spanning Tree Protocol  61.73503378     258542  25.00551483         6463550
Data                    38.11835441     159637  25.93865996         6704754

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2022-10-13 03:26:37 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

The reason the percent bytes isn't 100% Ethernet even though the percent packets is 100% Ethernet is because the statistics is only counting the Ethernet framing bytes as being Ethernet bytes, but not the Ethernet payload bytes.

Personally, I've never liked the way Wireshark computes these statistics, but that's the way Wireshark has behaved for the last 6+ years.

For more information and background, refer to Issue 1885: "Protocol Hierarchy Statistics" give misleading byte numbers.