1

In Wireshark's conversation view, do A and B map to source and destination?

3

It depends on the packets captured. For example, if the first packet it sees is from 1.2.3.4 to 5.6.7.8, then 1.2.3.4 becomes endpoint A, and 5.6.7.8 is B.

But if the first packet captured is 5.6.7.8 to 1.2.3.4, then it's the reverse.

3
  • So A is the machine that started the conversation?
    – ishmandoo
    Jan 30 '20 at 19:20
  • 1
    Not necessarily. It depends when your capture starts. You might start the capture in the middle of a conversation.
    – Ron Trunk
    Jan 30 '20 at 19:30
  • A is always the sender of that specific packet - not necessarily the source for the entire stream (the individual packet could just be part of a handshake response, for example). B is always the recipient of that specific packet - not necessarily the destination for the entire stream (the individual packet could just be part of a handshake response, for example).
    – Jesse P.
    Jan 31 '20 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.