https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16796
--- Comment #4 from Jaap Keuter <jaap.keu...@xs4all.nl> ---
(In reply to Christopher Maynard from comment #3)
> (In reply to Jaap Keuter from comment #2)
> > I think this is correct. The count is of the packets _crossing_ the
> > interface, both outbound and inbound. The first packet crosses the interface
> > (1) and comes right back (2), then the second packet crosses the interface
> > (3) and comes right back (4). The loopback interface is a odd duck in that
> > its both the egress and ingress interface for the packet at the same time.
>
> It's definitely not unique to the loopback address. Try a local ping of
> your computer's IP address and capture the traffic locally as well. The
> Endpoints statistics will be duplicated just the same is it is when pinging
> the loopback address.
Indeed, the results should be the same as the packet flow through the network
stack and interface is similar to the traffic for the loopback interface.
> Wireshark isn't a router. It's counting packets, not egress packets and
> ingress packets. There are 2 packets in the capture file so it's absurd
> that the packet count exceeds the total packets Wireshark sees.
In the Endpoint statistics it's counting packets _per endpoint_. Naturally a
packet egressing an endpoint will ingress another (the whole point of
networking). The endpoint statistics are meant to reflect that, in their Rx and
Tx counts, which culminates in total packets per interface. So yes, a packet
egressing an interface will ingress one at the other end of the path.
The count of packets _in the network_ is found in the Conversations statistics.
There the path between endpoints is listed and the packets exchanged on that
path, both in the forward and backward direction.
I think both statistics come into their own, providing a different view to the
same packet flow.
--
You are receiving this mail because:
You are watching all bug changes.
___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
