User Guide

Statistics
127
Note!
Protocol layers can consist of packets that won't contain any higher layer protocol, so the
sum of all higher layer packets may not sum up to the protocols packet count. Example: In
the screenshot TCP has 85,83% but the sum of the subprotocols (HTTP, ...) is much less.
This may be caused by TCP protocol overhead, e.g. TCP ACK packets won't be counted as
packets of the higher layer).
Note!
A single packet can contain the same protocol more than once. In this case, the protocol
is counted more than once. For example: in some tunneling configurations the IP layer can
appear twice.
8.4. Conversations
Statistics of the captured conversations.
8.4.1. What is a Conversation?
A network conversation is the traffic between two specific endpoints. For example, an IP conversation
is all the traffic between two IP addresses. The description of the known endpoint types can be found in
Section 8.5.1, “What is an Endpoint?”.
8.4.2. The "Conversations" window
The conversations window is similar to the endpoint Window; see Section 8.5.2, “The "Endpoints"
window” for a description of their common features. Along with addresses, packet counters, and byte
counters the conversation window adds four columns: the time in seconds between the start of the capture
and the start of the conversation ("Rel Start"), the duration of the conversation in seconds, and the average
bits (not bytes) per second in each direction.
Figure 8.3. The "Conversations" window