Re: How much overhead does a Wireshark capture file contain ?

[Jeff Morriss <jeff.morriss.ws () gmail com>]

Henry Meleg wrote:
> So I need to measure the traffic in bytes between two endpoints. If I 
> set up Wireshark on a laptop whose interface is enabled for promiscuous 
> mode and specify a capture filter between the source and destination IP 
> addresses that I am interested in and capture to a file then will that 
> file size be an accurate reflection of the traffic between the two endpoint.
>  
> Does Wireshark add any overhead to the capture file that I need to take 
> into account by subtracting it from the captured file size to get a 
> accurate traffic figure which I require to set up bandwidth management 
> filters.

The PCAP file format has both a per-file header and a per-packet header. 
  For details, see:

http://wiki.wireshark.org/Development/LibpcapFileFormat
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe