Beyond individual packet filters, Wireshark provides a Statistics menu full of tools that summarize entire captures. The Protocol Hierarchy view (Statistics > Protocol Hierarchy) shows a tree of every protocol found in the capture along with packet counts, byte counts, and percentages, which is a quick way to see which protocols dominate a trace. The Conversations window (Statistics > Conversations) lists every distinct conversation between two endpoints, broken down by Ethernet, IPv4, IPv6, TCP, UDP, and other protocols, and is invaluable for spotting heavy talkers. The related Endpoints window (Statistics > Endpoints) shows traffic aggregated per host, again segmented by layer.
Time-based analysis is supported by the I/O Graph (Statistics > I/O Graph) and the Flow Graph (Statistics > Flow Graph). The I/O Graph plots packet rate or byte rate over time on a configurable Y-axis, making it easy to visualize throughput, bursts, and gaps, and to compare multiple filters on the same timeline. The Flow Graph renders a directional picture of packet exchange between hosts, which is particularly helpful when reasoning about connection patterns. Service Response Time (Statistics > Service Response Time) measures the delay between request and reply for protocols like HTTP, SMB, and LDAP, while the Packet Lengths statistics (Statistics > Packet Lengths) histogram the distribution of frame sizes to surface MTU-related issues.
The Expert System provides an automated health check on a capture. By examining protocol behavior, it tags packets as Chat, Note, Warning, or Error, with these categories also accessible through filters like expert.message == "Warning" or expert.severity == 3. Typical warnings include Duplicate ACK, Fast Retransmission, Out-of-Order Segment, Previous Segment Not Captured, Spurious Retransmission, Zero Window, Window Update, Keep-Alive, Connection Reset, and Malformed Packet. The Expert Info window (Analyze > Expert Info) consolidates these into a single review pane, while statistics like Protocol Hierarchy, Conversations, and Endpoints complement it with quantitative summaries. The Summary window (Statistics > Capture File Properties) gives a one-glance view of the capture's size, duration, packet count, and interface details.