Statistics and Graphs

Capture File Properties

Statistics → Capture File Properties is the first thing to open on a file someone hands you. It reports the format, the interfaces and their capture filters, first and last timestamp, packet and byte counts, average rate, and any dropped-packet counts the capture engine recorded.

capinfos cap.pcapng                  # everything
capinfos -c -a -e -y -x cap.pcapng   # count, first, last, precision, rates
capinfos -T -m *.pcapng              # table output, comma separated, many files

Drops matter more than anything else on that screen. A capture with drops produces false retransmissions and false "previous segment not captured", so every performance conclusion drawn from it is suspect.

Conversations and Endpoints

Statistics → Conversations is the workhorse. One row per conversation, with packets and bytes in each direction, duration, and bit rate, at the Ethernet, IP, IPv6, TCP, and UDP levels. Sort by Bytes and the top talker is the first row.

- Limit to display filter checkbox restricts the table to the current filter. - Right-click a row → Apply as Filter → Selected → A ↔ B to isolate it. - The Stream ID column on the TCP tab is the tcp.stream index, so you can jump straight to Follow Stream.

Statistics → Endpoints is the same data collapsed to one side, which answers "which single host is doing this" rather than "which pair".

tshark -r cap.pcapng -q -z conv,tcp
tshark -r cap.pcapng -q -z conv,ip
tshark -r cap.pcapng -q -z endpoints,ip
tshark -r cap.pcapng -q -z endpoints,tcp

# Top talkers, sorted by bytes
tshark -r cap.pcapng -q -z conv,ip | sort -k7 -rn | head -20

Protocol Hierarchy

Statistics → Protocol Hierarchy is a tree of every protocol in the file with its packet count, byte count, and percentage of the capture. It is how you find the answer to "what is actually on this link".

tshark -r cap.pcapng -q -z io,phs
tshark -r cap.pcapng -q -z io,phs,tcp    # only within TCP

Reading it:

- Percentages are of the whole capture, not of the parent, so children of a layer do not sum to the parent's number. - A large data bucket under TCP means traffic Wireshark could not dissect, usually a nonstandard port. Fix it with Decode As. - Malformed at any level points at truncation. Check your snaplen.

Response Time and Service Stats

Wireshark computes request-to-response times for protocols with a request/response model. Statistics → Service Response Time has one entry per such protocol.

tshark -r cap.pcapng -q -z dns,tree
tshark -r cap.pcapng -q -z http,tree
tshark -r cap.pcapng -q -z plen,tree
tshark -r cap.pcapng -q -z "http_req,tree,http.host==api.example.com"

I/O Graph and io,stat

Statistics → I/O Graph plots up to ten series over time, each with its own display filter, Y axis (packets, bytes, bits per interval, or a field's COUNT/SUM/MIN/MAX/AVG/LOAD), and interval from 1 ms to 10 minutes. Click a point to jump to that packet.

A useful three-series setup: all packets in gray, tcp.analysis.retransmission in red, and tcp.analysis.zero_window in orange. Loss that correlates with a throughput cliff is visible in one glance.

# Packets and bytes per second
tshark -r cap.pcapng -q -z io,stat,1

# Three columns, one per filter
tshark -r cap.pcapng -q -z \
  io,stat,1,"ip","tcp.analysis.retransmission","tcp.flags.reset==1"

# Whole-file totals
tshark -r cap.pcapng -q -z io,stat,0,"tcp","udp","icmp"

# Average and max HTTP response time per 10-second bucket
tshark -r cap.pcapng -q -z io,stat,10,"AVG(http.time)http.time","MAX(http.time)http.time"

# Throughput of one stream, per second, in bits
tshark -r cap.pcapng -q -z "io,stat,1,SUM(tcp.len)tcp.len && tcp.stream==3"

The field in a COUNT(), SUM(), AVG(), MIN(), MAX(), or LOAD() calculation must also appear in the filter part, or the calculation silently fails. AVG(http.time) alone does not work, AVG(http.time)http.time does.

Stream and Flow Views

In the tcptrace view, the gap between the data line and the ACK line is the in-flight window, and a vertical stack of R markers is retransmission. Switch direction with the button at the bottom, since a graph only shows one way at a time.

# Flow graph equivalents
tshark -r cap.pcapng -q -z flow,tcp,network
tshark -r cap.pcapng -q -z flow,any,network
tshark -r cap.pcapng -q -z flow,icmp,network

Other graphs worth knowing: Statistics → Flow Graph limited to a display filter is the clearest way to show someone a broken handshake, and Statistics → RTP → RTP Streams plus Telephony → RTP → Stream Analysis reports jitter and loss for voice, which is the one place mean values genuinely matter.