Ethereal-users: Re: [Ethereal-users] (no subject)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 8 Oct 2001 10:49:24 -0700
On Mon, Oct 08, 2001 at 05:31:02PM +0000, Surena K.D. wrote:
> In the summay page, I summed up the percents (or packets) under the TCP 
> section,

To which summary page are you referring?

The one that pops up if you select "Summary" from the "Tools" menu
doesn't give counts of packets of particular types.

The one that pops up if you select "Protocol Hierarchy Statistics" from
the "Tools" menu does.  Is that the summary to which you're referring?

> and they did not equal the percent (or total number of packets) of 
> TCP. What causes this diffrence?

Assuming you're referring to the "Protocol Hierarchy Statistics" window,
a couple of things could cause it:

	1) TCP packets that contain no data (e.g., ACK-only packets, or
	   the initial or final 3-way handshake packets if they contain
	   no data) are not classified by the protocol running on the
	   connection, so they will not show up in items under the item
	   for TCP, even though they will show up in the item for TCP;

	2) TCP packets that contain data for a protocol that Ethereal
	   doesn't dissect also won't be classified by the protocol
	   running on the connection, as Ethereal doesn't know that
	   protocol.