Chris Sanders

One of the first windows you may often want to view when analyzing a capture file is the capture summary window. You can access this by opening a capture file and going to Statistics in the drop-down menu and selecting Summary. The wireshark summary window gives us a few really useful things. First of all, it gives us a time reference as to when the capture was taken as detailed in the first packet and last packet fields. Second of all, and one of the things I find most useful is the throughput fields displayed in this window. Here you can see the things such as the average packet size, total bytes captures, and the average Mbytes per second. I often will use the Mbit/sec to determine congestion on the wire. You can compare this number with the line speed on the network (100 Mbit/sec, 1 GB/sec, etc) to determine if you are seeing congestion that might cause packet loss.

Be Sociable, Share!

•