[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

You are absolutely correct.  Ethereal uses the packet_length   and not
the  capture_length for these calculations.  (At least when the
capture file happens to be such a
format that provides both these numbers.)



Would you like to add a page to the wiki with some description of
io-stat ,  bytes/second
measurements,  how to use it and maybe some nice screenshots?






On Mon, 24 Jan 2005 11:52:02 +0200, Alexandros Papadopoulos
<apapadop@xxxxxxxxxxxxxx> wrote:
> Dear all
> 
> I've captured some traffic data with tcpdump's default options (thus,
> snaplen==96).
> 
> Now I'm examining the packet stream in ethereal, which understands that
> packets have been trimmed - for each such frame it displays something
> like:
> Frame 137 (126 bytes on wire, 96 bytes captured)
> 
> It looks like the IO graphs created with these packets refrect the real
> size of the packet (126 bytes) and not just the captured 96 bytes,
> which is The Right Thing To Do (TM).
> 
> I'd like a confirmation from someone more knowledgeable on ethereal that
> this is indeed the case.
> 
> Thank you.
> 
> -A
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>