Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not listed in subvariants/subprotocols)
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Nov 19, 2022 at 23:21
Add a comment
|
1 Answer
Each hierarchical item contains subitems that should sum up to the same amount - however, there's no Other and that figure is omitted.
For instance, Internet Protocol version 4 contains (is the sum of) User Datagram Protocol, Transmission Control Protocol, Internet Group Management Protcol, Internet Control Message Protocol, and (omitted) Other.
Transmission Control Protocol just lists some subvariants that don't sum up nicely (there's a rather large Other).
-
Hi Zac, Originally I had actually posted this thread as "Wireshark Protocol Hierarchy omitting large amount of packet data". So this would make sense, I was wondering why my subprotocols were not adding to account for the Protocol's traffic. What exactly is going on here, is it a matter of my wireshark preferences omitting this 'other' data or something else. If it helps, and not to be conspiratorial, I've expressed concern of being compromised which is part my reason for delving into packet analysis and other areas of device security.– N SNov 19, 2021 at 7:36
-
If needed I can transfer this question to another appropriate stack-exchange– N SNov 19, 2021 at 7:45
-
Wireshark only displays common protocols and variants. I can see no easy way to customize the display aside from working on the source code (which should be addressed elsewhere)... However, Wireshark isn't a very good tool for statistical monitoring - perhaps you should look into Netflow or sFlow tools instead.– Zac67 ♦Nov 19, 2021 at 7:50
-
Would questions posed towards malware activity be valid here? From my understanding Wireshark doesn't have the dissectors to analyze the remaining ~70% subprotocol traffic being generated in this capture?– N SNov 19, 2021 at 7:53
-
Wireshark can very well analyze packets that you have defined (compare microscope) - dissecting mass traffic into known and unknown flows should be done with statistically working tools. Malware activity is above the transport layer, so it's off-topic here. Depending on your goals, it might be on-topic on Server Fault - but please do check their scope before posting.– Zac67 ♦Nov 19, 2021 at 7:59