Wireshark-bugs: [Wireshark-bugs] [Bug 1885] "Protocol Hierarchy Statistics" give misleading byte
Comment # 4
on bug 1885
from Christopher Maynard
(In reply to Gerrit Code Review from comment #3)
> Change 14392 merged by Michael Mann:
> Use field info length instead of packet length for protocol hierarchy stats.
>
> https://code.wireshark.org/review/14392
Judging by the results, this looks like the wrong approach to me.
For example, previously statistics showed something like this:
Protocol % Packets Packets % Bytes Bytes
- Frame 100.00% 40 100.00% 3660
- Ethernet 100.00% 40 100.00% 3660
- IPv4 100.00% 40 100.00% 3660
- TCP 100.00% 40 100.00% 3660
... but now it shows this:
Protocol % Packets Packets % Bytes Bytes
- Frame 100.00% 40 100.00% 3660
- Ethernet 100.00% 40 15.30% 560
- IPv4 100.00% 40 21.86% 800
- TCP 100.00% 40 62.84% 2300
What it ought to show is this:
Protocol % Packets Packets % Bytes Bytes
- Frame 100.00% 40 100.00% 3660
- Ethernet 100.00% 40 100.00% 3660*
- IPv4 100.00% 40 84.70% 3100**
- TCP 100.00% 40 62.84% 2300
*All the data is Ethernet data
**3100 calculated from 3660 - (40 * 14): All the data is IPv4 data except for
the 14 bytes of Ethernet overhead per packet (there are no trailing Ethernet
FCS bytes in this case)
We should always see numbers grow consistently smaller as each protocol's
overhead is excluded from the statistics of the next layer.
You are receiving this mail because:
- You are the assignee for the bug.
- You are watching all bug changes.
