Protocol Hierarchy to analyze

edit

I think the answer here should be - it depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "BPDU filter" mode or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.

10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets. It's a good idea to look at their source and type.