Wireshark transforms raw packet data into actionable insight through a rich set of statistical tools accessible from the Statistics menu. Protocol Hierarchy presents a tree view of all protocols in the capture along with packet counts, byte totals, and percentage breakdowns, making it easy to spot unexpected protocols or to verify the composition of a network. Conversations aggregates traffic between pairs of endpoints and supports multiple transport types, including Ethernet, IPv4, IPv6, TCP, and UDP, displaying packet counts, byte counts, and duration for each. Endpoints complements Conversations by listing individual network endpoints, whether IP addresses, MAC addresses, or TCP/UDP ports, alongside their associated traffic statistics. Together, these three views form the foundation of high-level traffic characterization.
Time-series and protocol-specific analytics are equally accessible. I/O Graphs plot packet or byte rates over time, with configurable Y-axis units (packets per tick or bytes per tick) and filters that allow multiple graphed series on a single chart, which is invaluable for spotting throughput anomalies, periodic communication, or burst patterns. Flow Graphs provide a visual representation of packet exchanges between endpoints, useful for tracing the order of messages in a TCP exchange or a higher-level conversation. Service Response Time statistics measure the elapsed time between requests and their responses for protocols that have a clear request/response structure, such as HTTP, SMB, and LDAP. Packet Lengths displays a histogram of packet sizes, helping to identify MTU issues or atypical frame distributions, while DNS Statistics and HTTP Statistics present aggregate views of those protocols, including query and response counts, status codes, load distribution, and timing.
Wireshark's Expert System acts as an automated advisor, parsing the capture for known patterns and surfacing them as categorised messages. The system operates at four severity levels, indicated by expert.severity: Chat for routine information, Note for noteworthy but non-issues, Warning for likely problems, and Error for definite issues. Specific expert messages include Duplicate ACK, Fast Retransmission, Keep-Alive, Previous Segment Not Captured, Out-of-Order Segment, Spurious Retransmission, Connection Reset, Zero Window, Window Update, and Malformed Packet, each described by the expert.message field. The Expert Info window, accessible via Analyze > Expert Info, consolidates all of these messages for easy review and serves as a first stop in diagnosing both connectivity problems and performance issues. Other useful summary tools include the Summary window, which reports overall file size, duration, packet count, and capture interface information, and Resolved Addresses, which lists the results of name resolution for IP addresses, MAC addresses, and port numbers.