Protocol hierarchy and the I/O graph
Hierarchy says what the file is made of. The I/O graph says when a filtered slice of it happened.
Percentages are of the file
Statistics, then Protocol Hierarchy, is a tree of bytes and packets by protocol. It answers “what is in this file.” It does not answer “what is on the network,” because a capture filter already threw frames away, and a capture point already chose a view. Read the percentages as shares of the saved file.
The limit-to-display-filter choice matters here too. A hierarchy of a file filtered to one host is a description of that host’s captured traffic. Write the filter next to any percentage you quote. A pie of “80 percent TLS” is meaningless without the denominator.
Time on one axis, a filter on the line
Statistics, then I/O Graph, plots packets or bytes over time. The interval, one second or ten, changes what a spike is. Add a second graph with a display filter, for example the lab server’s TCP/443, and leave the first graph as the whole view. A spike that appears in both is the server. A spike that appears only in the whole view is someone else.
The Y axis unit changes the story. Packet counts make a scan of SYNs look large. Byte counts make a file copy look large and a scan look like a flat line. Pick the unit that matches the question, and include it in the note. Read the time on the bucket, then filter the list to that window with the timestamps. The picture is how you choose frames. The frames are the evidence.
Worked case: the spike was the backup, not the DNS errors
The hierarchy of a noon lab file is mostly TLS to 10.8.0.20, plus a thin DNS stripe. The I/O graph in bytes, ten-second buckets, shows one spike at 12:10. A second series filtered to ip.addr == 10.8.0.40 && ip.addr == 10.8.0.20 && tcp.port == 443 rises with it. A third series for dns stays flat. The spike is the client’s encrypted transfer, not a DNS storm.
You take 12:10 from the graph and filter the list to that minute, then open the conversation with the byte count. The graph told you where to look. The conversation list told you who the bytes belonged to. The note says “bytes, 10-second buckets, filtered to the client and the server on 443.”
ip.addr == 10.8.0.40 && ip.addr == 10.8.0.20 && tcp.port == 443
A text graph you can paste
tshark can print an I/O statistic from a saved file. An interval and a filter give you a column of counts without a screenshot. Keep the unit and the interval in the heading you write above the paste.
Hierarchy and the graph are how you choose a stream to read carefully. They are a bad place to stop. A percentage is not a finding until you can name the frames.
tshark -n -r lab.pcapng -q -z "io,stat,10,ip.addr==10.8.0.40 && ip.addr==10.8.0.20 && tcp.port==443"
Diagram
From a share of the file to a ten-second window you can open
- Share
Read Protocol Hierarchy as a share of this file, after you check the display-filter checkbox.
- Unit
Choose packets or bytes in the I/O graph to match the question.
- Series
Add the conversation as a second series.
ip.addr == 10.8.0.40 && ip.addr == 10.8.0.20 && tcp.port == 443
- Frames
Note the bucket’s time, filter the list to that window, and name the conversation.
Check yourself
1. Protocol Hierarchy says 90 percent TLS. What is the denominator?
2. You want a large file copy to stand out against a burst of SYNs. Which graph unit does that?
3. You paste an I/O statistic into the notes. What has to be written above it?