User Guide
Wireshark User's Guide
vi
7.2. Following TCP streams ...................................................................................... 117
7.2.1. The "Follow TCP Stream" dialog box ......................................................... 117
7.3. Expert Infos ..................................................................................................... 118
7.3.1. Expert Info Entries ................................................................................. 119
7.3.2. "Expert Info" dialog ................................................................................ 120
7.3.3. "Colorized" Protocol Details Tree .............................................................. 120
7.3.4. "Expert" Packet List Column (optional) ...................................................... 121
7.4. Time Stamps .................................................................................................... 121
7.4.1. Wireshark internals ................................................................................. 121
7.4.2. Capture file formats ................................................................................ 122
7.4.3. Accuracy ............................................................................................... 122
7.5. Time Zones ...................................................................................................... 122
7.5.1. Set your computer's time correctly! ............................................................ 123
7.5.2. Wireshark and Time Zones ....................................................................... 124
7.6. Packet Reassembling ......................................................................................... 125
7.6.1. What is it? ............................................................................................ 125
7.6.2. How Wireshark handles it ........................................................................ 125
7.7. Name Resolution .............................................................................................. 126
7.7.1. Name Resolution drawbacks ..................................................................... 126
7.7.2. Ethernet name resolution (MAC layer) ....................................................... 127
7.7.3. IP name resolution (network layer) ............................................................ 127
7.7.4. IPX name resolution (network layer) .......................................................... 128
7.7.5. TCP/UDP port name resolution (transport layer) ........................................... 128
7.8. Checksums ....................................................................................................... 128
7.8.1. Wireshark checksum validation ................................................................. 129
7.8.2. Checksum offloading ............................................................................... 129
8. Statistics .................................................................................................................... 130
8.1. Introduction ..................................................................................................... 130
8.2. The "Summary" window .................................................................................... 130
8.3. The "Protocol Hierarchy" window ........................................................................ 131
8.4. Conversations ................................................................................................... 133
8.4.1. What is a Conversation? .......................................................................... 133
8.4.2. The "Conversations" window .................................................................... 133
8.4.3. The protocol specific "Conversation List" windows ....................................... 134
8.5. Endpoints ........................................................................................................ 134
8.5.1. What is an Endpoint? .............................................................................. 134
8.5.2. The "Endpoints" window ......................................................................... 135
8.5.3. The protocol specific "Endpoint List" windows ............................................ 136
8.6. The "IO Graphs" window ................................................................................... 136
8.7. Service Response Time ...................................................................................... 137
8.7.1. The "Service Response Time DCE-RPC" window ......................................... 138
8.8. Compare two capture files .................................................................................. 138
8.9. WLAN Traffic Statistics ..................................................................................... 140
8.10. The protocol specific statistics windows .............................................................. 140
9. Telephony .................................................................................................................. 141
9.1. Introduction ..................................................................................................... 141
9.2. RTP Analysis ................................................................................................... 141
9.3. VoIP Calls ....................................................................................................... 141
9.4. LTE MAC Traffic Statistics ................................................................................ 142
9.5. LTE RLC Traffic Statistics ................................................................................. 142
9.6. The protocol specific statistics windows ................................................................ 143
10. Customizing Wireshark ............................................................................................... 144
10.1. Introduction .................................................................................................... 144
10.2. Start Wireshark from the command line ............................................................... 144