From 9968c7cc96dd336c09070929a724eefc59163cd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stig=20Bj=C3=B8rlykke?= Date: Sun, 17 Feb 2008 14:33:06 +0000 Subject: Updated the User Guide: - Added description for WLAN Traffic statistics. - Added "Limit to display filter" description in conversations and endpoints. - Added a tip in IO Graphs to click in the graph to select a matching packet. - Some indentation fixes. svn path=/trunk/; revision=24371 --- docbook/user-guide.xml | 1 + docbook/wsug_graphics/ws-stats-conversations.png | Bin 72281 -> 76132 bytes docbook/wsug_graphics/ws-stats-endpoints.png | Bin 65043 -> 65051 bytes docbook/wsug_graphics/ws-stats-iographs.png | Bin 54125 -> 53933 bytes docbook/wsug_graphics/ws-stats-wlan-traffic.png | Bin 0 -> 36008 bytes docbook/wsug_src/WSUG_chapter_statistics.xml | 288 ++++++++++++++--------- 6 files changed, 173 insertions(+), 116 deletions(-) create mode 100644 docbook/wsug_graphics/ws-stats-wlan-traffic.png diff --git a/docbook/user-guide.xml b/docbook/user-guide.xml index 288e2a4579..e272419654 100644 --- a/docbook/user-guide.xml +++ b/docbook/user-guide.xml @@ -245,6 +245,7 @@ FILE SECTION + diff --git a/docbook/wsug_graphics/ws-stats-conversations.png b/docbook/wsug_graphics/ws-stats-conversations.png index 7697bf465e..a728abfeb7 100644 Binary files a/docbook/wsug_graphics/ws-stats-conversations.png and b/docbook/wsug_graphics/ws-stats-conversations.png differ diff --git a/docbook/wsug_graphics/ws-stats-endpoints.png b/docbook/wsug_graphics/ws-stats-endpoints.png index a0f32da949..57db13960f 100644 Binary files a/docbook/wsug_graphics/ws-stats-endpoints.png and b/docbook/wsug_graphics/ws-stats-endpoints.png differ diff --git a/docbook/wsug_graphics/ws-stats-iographs.png b/docbook/wsug_graphics/ws-stats-iographs.png index 41698ed8ba..bdae7d698e 100644 Binary files a/docbook/wsug_graphics/ws-stats-iographs.png and b/docbook/wsug_graphics/ws-stats-iographs.png differ diff --git a/docbook/wsug_graphics/ws-stats-wlan-traffic.png b/docbook/wsug_graphics/ws-stats-wlan-traffic.png new file mode 100644 index 0000000000..9cc597b101 Binary files /dev/null and b/docbook/wsug_graphics/ws-stats-wlan-traffic.png differ diff --git a/docbook/wsug_src/WSUG_chapter_statistics.xml b/docbook/wsug_src/WSUG_chapter_statistics.xml index ad4ca632a4..5a5c94d4a3 100644 --- a/docbook/wsug_src/WSUG_chapter_statistics.xml +++ b/docbook/wsug_src/WSUG_chapter_statistics.xml @@ -191,138 +191,157 @@
Conversations - Statistics of the captured conversations. + Statistics of the captured conversations. -
What is a Conversation? - +
+ What is a Conversation? + A network conversation is the traffic between two specific endpoints. For example, an IP conversation is all the traffic between two IP addresses. The description of the known endpoint types can be found in . - -
-
The "Conversations" window + +
+
The "Conversations" window - Other than the list content, the conversations window works the same way as the - endpoint Window; see for a - description how it works. -
The "Conversations" window - -
+ Other than the list content, the conversations window works the same way as the + endpoint Window; see for a + description how it works. +
The "Conversations" window + +
- The copy button will copy the list values to the - clipboard in CSV (Comma Seperated Values) format. - -
-
- The protocol specific "Conversation List" windows - - Before the combined window described above was available, each of its - pages was shown as a separate window. Even though the combined window is - much more convenient to use, these separate windows are still - available. The main reason is that they might process faster for - very large capture files. However, as the functionality is exactly the - same as in the combined window, they won't be discussed in detail here. - -
-
- -
- Endpoints - - Statistics of the endpoints captured. - Tip! - - If you are looking for a feature other network tools call a - hostlist, here is the right place to look. The list of - Ethernet or IP endpoints is usually what you're looking for. - - + Each row in the list shows the statistical values for exactly one conversation. -
What is an Endpoint? - A network endpoint is the logical endpoint of separate protocol traffic of - a specific protocol layer. The endpoint statistics of Wireshark will take - the following endpoints into account: + Name resolution will be done if selected in the window + and if it is active for the specific protocol layer (MAC layer for the + selected Ethernet endpoints page). - - - Ethernet: an Ethernet endpoint is identical to the - Ethernet's MAC address. + Limit to display filter will only show conversations matching + the current display filter. - - - Fibre Channel: XXX - insert info here. + The copy button will copy the list values to the + clipboard in CSV (Comma Seperated Values) format. - - + Tip! - FDDI: a FDDI endpoint is identical to the FDDI MAC - address. + This window will be updated frequently, so it will be useful, even if + you open it before (or while) you are doing a live capture. - - - - IPv4: an IP endpoint is identical to its IP address. - - - - - IPX: XXX - insert info here. - - - + +
+
+ The protocol specific "Conversation List" windows + + Before the combined window described above was available, each of its + pages was shown as a separate window. Even though the combined window is + much more convenient to use, these separate windows are still + available. The main reason is that they might process faster for + very large capture files. However, as the functionality is exactly the + same as in the combined window, they won't be discussed in detail here. + +
+
+ +
+ Endpoints - TCP: a TCP endpoint is a combination of the IP address - and the TCP port used, so different TCP ports on the same IP address are - different TCP endpoints. + Statistics of the endpoints captured. + Tip! + + If you are looking for a feature other network tools call a + hostlist, here is the right place to look. The list of + Ethernet or IP endpoints is usually what you're looking for. + + - - +
What is an Endpoint? - Token Ring: a Token Ring endpoint is identical to the - Token Ring MAC address. + A network endpoint is the logical endpoint of separate protocol traffic of + a specific protocol layer. The endpoint statistics of Wireshark will take + the following endpoints into account: - - - - UDP: a UDP endpoint is a combination of the IP address - and the UDP port used, so different UDP ports on the same IP address are - different UDP endpoints. - - - - Broadcast / multicast endpoints + + - Broadcast / multicast traffic will be shown separately as additional - endpoints. Of course, as these endpoints are virtual endpoints, the real - traffic will be received by all (multicast: some) of the listed unicast - endpoints. + Ethernet: an Ethernet endpoint is identical to the + Ethernet's MAC address. - -
-
- The "Endpoints" window + + - This window shows statistics about the endpoints captured. + Fibre Channel: XXX - insert info here. -
The "Endpoints" window - -
+ + + FDDI: a FDDI endpoint is identical to the FDDI MAC + address. + + + + + IPv4: an IP endpoint is identical to its IP address. + + + + + IPX: XXX - insert info here. + + + + + TCP: a TCP endpoint is a combination of the IP address + and the TCP port used, so different TCP ports on the same IP address are + different TCP endpoints. + + + + + Token Ring: a Token Ring endpoint is identical to the + Token Ring MAC address. + + + + + UDP: a UDP endpoint is a combination of the IP address + and the UDP port used, so different UDP ports on the same IP address are + different UDP endpoints. + + + + Broadcast / multicast endpoints + + Broadcast / multicast traffic will be shown separately as additional + endpoints. Of course, as these endpoints are virtual endpoints, the real + traffic will be received by all (multicast: some) of the listed unicast + endpoints. + + +
+
+ The "Endpoints" window + + This window shows statistics about the endpoints captured. + +
The "Endpoints" window + +
+ For each supported protocol, a tab is shown in this window. Each tab label shows the number of endpoints captured (e.g. the tab label "Ethernet: 5" tells you that five ethernet endpoints have been captured). If no endpoints of a specific protocol were captured, the tab label will be greyed out (although the related page can still be selected). - - + + Each row in the list shows the statistical values for exactly one endpoint. - - + + Name resolution will be done if selected in the window and if it is active for the specific protocol layer (MAC layer for the selected Ethernet endpoints page). As you might have noticed, the first @@ -331,29 +350,33 @@ resolved to an IP address (using ARP) and the third was resolved to a broadcast (unresolved this would still be: ff:ff:ff:ff:ff:ff); the last two Ethernet addresses remain unresolved. - - - The copy button will copy the list values to the - clipboard in CSV (Comma Seperated Values) format. - - Tip! - + + + Limit to display filter will only show conversations matching + the current display filter. + + + The copy button will copy the list values to the + clipboard in CSV (Comma Seperated Values) format. + + Tip! + This window will be updated frequently, so it will be useful, even if you open it before (or while) you are doing a live capture. - - -
-
- The protocol specific "Endpoint List" windows - + + +
+
+ The protocol specific "Endpoint List" windows + Before the combined window described above was available, each of its pages was shown as a separate window. Even though the combined window is much more convenient to use, these separate windows are still available. The main reason is that they might process faster for very large capture files. However, as the functionality is exactly the same as in the combined window, they won't be discussed in detail here. - -
+ +
@@ -458,13 +481,46 @@ graphs to the clipboard in CSV (Comma Seperated Values) format. The copy feature is only available in Wireshark version 0.99.8 or higher. + Tip! + + Click in the graph to select the first package in the selected interval. + +
WLAN Traffic Statistics - Statistics of the captured WLAN traffic. + Statistics of the captured WLAN traffic. This window will summarize the + wireless network traffic found in the capture. Probe requests will be + merged into an existing network if the SSID matches. + + +
The "WLAN Traffic Statistics" window + +
+ + + Each row in the list shows the statistical values for exactly one wireless network. + + + Name resolution will be done if selected in the window + and if it is active for the MAC layer. + + + Only show existing networks will exclude probe requests + with a SSID not matching any network from the list. + + + The copy button will copy the list values to the + clipboard in CSV (Comma Seperated Values) format. + + Tip! + + This window will be updated frequently, so it will be useful, even if + you open it before (or while) you are doing a live capture. +
-- cgit v1.2.1