User Guide

Statistics
134
Each row in the list shows the statistical values for exactly one conversation.
Name resolution will be done if selected in the window and if it is active for the specific protocol layer
(MAC layer for the selected Ethernet endpoints page).
Limit to display filter will only show conversations matching the current display filter.
The copy button will copy the list values to the clipboard in CSV (Comma Separated Values) format.
Tip!
This window will be updated frequently, so it will be useful, even if you open it before (or
while) you are doing a live capture.
8.4.3. The protocol specific "Conversation List" windows
Before the combined window described above was available, each of its pages was shown as a separate
window. Even though the combined window is much more convenient to use, these separate windows are
still available. The main reason is that they might process faster for very large capture files. However, as
the functionality is exactly the same as in the combined window, they won't be discussed in detail here.
8.5. Endpoints
Statistics of the endpoints captured.
Tip!
If you are looking for a feature other network tools call a hostlist, here is the right place to
look. The list of Ethernet or IP endpoints is usually what you're looking for.
8.5.1. What is an Endpoint?
A network endpoint is the logical endpoint of separate protocol traffic of a specific protocol layer. The
endpoint statistics of Wireshark will take the following endpoints into account:
• Ethernet: an Ethernet endpoint is identical to the Ethernet's MAC address.
• Fibre Channel: XXX - insert info here.
• FDDI: a FDDI endpoint is identical to the FDDI MAC address.
• IPv4: an IP endpoint is identical to its IP address.
• IPX: an IPX endpoint is concatenation of a 32 bit network number and 48 bit node address, be default
the Ethernets' MAC address.
• JXTA: a JXTA endpoint is a 160 bit SHA-1 URN.
• NCP: XXX - insert info here.
• RSVP: XXX - insert info here.
• SCTP: a SCTP endpoint is a combination of the host IP addresses (plural) and the SCTP port used. So
different SCTP ports on the same IP address are different SCTP endpoints, but the same SCTP port on
different IP addresses of the same host are still the same endpoint.