3

When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded.

for example

700000 bytes shows in pcap

680000 bytes shows in original file size

3
  • 1
    This is simply a false assumption. I am looking at a Wireshark capture at the moment where Wireshark shows bytes captured as 392,187 and the file size is 493,132. – YLearn Sep 20 '15 at 15:27
  • so why is the difference? – Bilal Sep 20 '15 at 16:14
  • 1
    Because data on the wire is not the same as data stored to disk by an application. Why can you save the same document in your favorite word processing in a variety of different formats and they have different sizes? – YLearn Sep 20 '15 at 17:53
1

It's just protocol overhead. YOur file is cut into smaler bites, gets tcp header, gets ip header, gets ethernet header ...

1
  • Got the point that's correct. – Bilal Sep 20 '15 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.