[Wireshark-bugs] [Bug 16796] Endpoints statistics duplicates packet and byte counts when endpoint is the same.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16796 --- Comment #5 from Christopher Maynard --- (In reply to Jaap Keuter from comment #4) > In the Endpoint statistics it's counting packets _per endpoint_. Naturally a > packet egressing an endpoint will ingress another (the whole point of > networking). The endpoint statistics are meant to reflect that, in their Rx > and Tx counts, which culminates in total packets per interface. So yes, a > packet egressing an interface will ingress one at the other end of the path. > > The count of packets _in the network_ is found in the Conversations > statistics. There the path between endpoints is listed and the packets > exchanged on that path, both in the forward and backward direction. > > I think both statistics come into their own, providing a different view to > the same packet flow. There are 2 packets in the capture file. Any number higher than 2 in the "Packets" column can't possibly be correct. The question the "Packets" column answers is, "Of the 2 total packets in the capture file, how many of them did this particular endpoint either send or receive?" The answer is 2. If you provide an answer of 4, then you're not counting packets, you're counting something else. I suppose you're counting "Instances of an Endpoint occurring as either the transmitter or the receiver of a packet", but then the column name should be changed from "Packets" to "Instances of an Endpoint occurring as either the transmitter or the receiver of a packet" in order for the value of 4 to make any sense. I'd prefer Wireshark simply not duplicate the packets and bytes counting as it's doing now rather than change the column names to reflect what it is doing now. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:[email protected]?subject=unsubscribe
[Wireshark-bugs] [Bug 16796] Endpoints statistics duplicates packet and byte counts when endpoint is the same.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16796 --- Comment #4 from Jaap Keuter --- (In reply to Christopher Maynard from comment #3) > (In reply to Jaap Keuter from comment #2) > > I think this is correct. The count is of the packets _crossing_ the > > interface, both outbound and inbound. The first packet crosses the interface > > (1) and comes right back (2), then the second packet crosses the interface > > (3) and comes right back (4). The loopback interface is a odd duck in that > > its both the egress and ingress interface for the packet at the same time. > > It's definitely not unique to the loopback address. Try a local ping of > your computer's IP address and capture the traffic locally as well. The > Endpoints statistics will be duplicated just the same is it is when pinging > the loopback address. Indeed, the results should be the same as the packet flow through the network stack and interface is similar to the traffic for the loopback interface. > Wireshark isn't a router. It's counting packets, not egress packets and > ingress packets. There are 2 packets in the capture file so it's absurd > that the packet count exceeds the total packets Wireshark sees. In the Endpoint statistics it's counting packets _per endpoint_. Naturally a packet egressing an endpoint will ingress another (the whole point of networking). The endpoint statistics are meant to reflect that, in their Rx and Tx counts, which culminates in total packets per interface. So yes, a packet egressing an interface will ingress one at the other end of the path. The count of packets _in the network_ is found in the Conversations statistics. There the path between endpoints is listed and the packets exchanged on that path, both in the forward and backward direction. I think both statistics come into their own, providing a different view to the same packet flow. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:[email protected]?subject=unsubscribe
[Wireshark-bugs] [Bug 16796] Endpoints statistics duplicates packet and byte counts when endpoint is the same.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16796 --- Comment #3 from Christopher Maynard --- (In reply to Jaap Keuter from comment #2) > I think this is correct. The count is of the packets _crossing_ the > interface, both outbound and inbound. The first packet crosses the interface > (1) and comes right back (2), then the second packet crosses the interface > (3) and comes right back (4). The loopback interface is a odd duck in that > its both the egress and ingress interface for the packet at the same time. It's definitely not unique to the loopback address. Try a local ping of your computer's IP address and capture the traffic locally as well. The Endpoints statistics will be duplicated just the same is it is when pinging the loopback address. Wireshark isn't a router. It's counting packets, not egress packets and ingress packets. There are 2 packets in the capture file so it's absurd that the packet count exceeds the total packets Wireshark sees. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:[email protected]?subject=unsubscribe
[Wireshark-bugs] [Bug 16796] Endpoints statistics duplicates packet and byte counts when endpoint is the same.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16796 --- Comment #2 from Jaap Keuter --- I think this is correct. The count is of the packets _crossing_ the interface, both outbound and inbound. The first packet crosses the interface (1) and comes right back (2), then the second packet crosses the interface (3) and comes right back (4). The loopback interface is a odd duck in that its both the egress and ingress interface for the packet at the same time. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:[email protected]?subject=unsubscribe
[Wireshark-bugs] [Bug 16796] Endpoints statistics duplicates packet and byte counts when endpoint is the same.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16796 --- Comment #1 from Christopher Maynard --- This bug affects tshark as well. Running "tshark.exe -q -r ping1_lo.pcap -z endpoints,ip" shows: IPv4 Endpoints Filter: | Packets | | Bytes | | Tx Packets | | Tx Bytes | | Rx Packets | | Rx Bytes | localhost 4 392 2 196 2 196 Similar results for "tshark.exe -q -r ping1_lo.pcap -z endpoints,eth" -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:[email protected]?subject=unsubscribe
