3

When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded.

for example

700000 bytes shows in pcap

680000 bytes shows in original file size

3
  • 1
    This is simply a false assumption. I am looking at a Wireshark capture at the moment where Wireshark shows bytes captured as 392,187 and the file size is 493,132.
    – YLearn
    Sep 20, 2015 at 15:27
  • so why is the difference?
    – Bilal
    Sep 20, 2015 at 16:14
  • 1
    Because data on the wire is not the same as data stored to disk by an application. Why can you save the same document in your favorite word processing in a variety of different formats and they have different sizes?
    – YLearn
    Sep 20, 2015 at 17:53

1 Answer 1

1

It's just protocol overhead. YOur file is cut into smaler bites, gets tcp header, gets ip header, gets ethernet header ...

1
  • Got the point that's correct.
    – Bilal
    Sep 20, 2015 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.