Confusion about TCP packet analysis terms
- by Berkay
I'm analyzing our network and have some confusion about the terms:
this is the 2-packet output from source to destination.
from these i have to get some features as describe, pls make me clear...
packets with at least a bytes of TCP data payload: it seems tcp.len0;
The minimum segment size (confusion is headers are included or or not)
The average segment size observed during the lifetime of the connection,
the definition: is calculated as the value reported in the actual data bytes divided by the actual data pkts reported.
Total bytes in IP packets, should be ip_len value.
Total bytes in (Ethernet)
The total number of bytes sent
probably related to frame.len and frame.cap_len
these two terms are describes as, also make me clear about these two terms.
frame.cap_len: Frame length stored into the capture file
frame.len: Frame length on the wire
