1

When I use the WireShark check the packages:

enter image description here

there have three place signs I don't understand.

  1. the [ means what? two IPs communicative to each other? but there have other IP in the range. you see the pair(192.168.2.228 - 123.58.180.8), there also have other IP (like 113.96.12.224).

2.what's the meaning of -> and <-?

3

The [ bracket encompasses packets that belong to a single 'connection'.

While that is self-explanatory for TCP and maybe UDP, Wireshark considers ICMP echo requests/replies between two hosts also as a 'connection. Note that only the 'connection' is shown that belongs to the currently selected packet.

The → and ← are similar: they show the 'partner' packet to the currently selected one.

In your example, you've selected inbound #45 which is a reply to outbound #44, and the whole 'connection' started in #35. Note the dotted line in front of #38, #39 and #42 that don't belong to the selected connection.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.