[Guy Harris <gharris@xxxxxxxxx>]

David Conaway wrote:
> I’ve been using Ethereal for several weeks now to examine network 
> traffic on a test I’m running, and it’s been extremely helpful!
>
> However, I’m wondering if there is a way to determine the number of 
> sockets open at any given time during a capture.

"Sockets" in the sense of the file descriptors/handles returned by 
socket() calls, or "sockets" in the sense of transport-layer endpoints 
(IP address/port, for TCP)?

For the former, no - network traces don't keep track of local 
information such as that.

For that latter, currently, no (you can get a list of all the endpoints 
in a capture, but not a count of the ones open at any given point in the 
capture), but in theory a tap could be written to provide that 
information.  Unfortunately, there's currently no convenient extension 
language to let people write taps easily.