This window shows how often each value of one or more fields occurs in the capture, with the respective counts and percentages. Additionally, an Entropy value (Normalized Shannon) is computed. Every field type is supported except protocol items and text-only labels.
You can launch it directly from the Statistics menu, or by a right-click on a field in the packet details tree, which opens the dialog with that field already entered. The dialog is also available in Stratoshark, where it counts events instead of packets.
The dialog has the following controls:
- Fields
-
Enter one field name, or up to 4 field names separated by a "," (comma) to get a joint
distribution. Field names are completed while you type. If an entry cannot be used, for example because
a field is unknown or has an unsupported type, a message appears below the edit box and is
disabled. For example,
ip.ttl,ip.srcshows all of the TTLs for each IP address seen in the capture. - Display filter
- Optionally limits the statistics to the packets matching this display filter.
- Counts the values of the entered fields and fills the table. The table is not updated while you edit the fields until you press .
- Resolve values
- Shows resolved names (for example, enumerated value names) instead of raw values. Filters built from a row always use the raw value.
- Show chart
- Shows a bar chart of the values with the highest counts beside the table.
The table has a column for each field, followed by Count and Percent columns. Click a column header to sort by it; numeric and address fields sort by value. Percentages are relative to the number of packets that were counted, not to the sum of the counts. A packet that contains a field more than once is counted once for each value, so the percentages can add up to more than 100 %. A line below the table summarizes the result: the number of distinct values, the number of packets that contain the fields, the number of observations and the Entropy.
Right-click a row to open the context menu:
- , , and build a display filter from the row’s values and use it in the main window.
- copies the selected rows as text.
- copies the display filter of the row.
- saves the table.
- opens an I/O Graph with one graph for each selected row. If a Display filter was applied, it is combined with each row’s filter and also added as a graph.
The button along the bottom copies the whole table as text, saves it in various formats, and opens an I/O Graph for the selected rows, as the context menu entry does. The number of rows one I/O Graph can show is limited; the tooltip of the button states the limit. opens this section and closes the dialog.
![[Note]](images/note.svg) | Note |
|---|---|
|
A high Entropy value (between 0.9 and 1) indicates that values are rather evenly distributed, while a low value (0 - 0.5) on the contrary indicates one or more dominant values. |
![[Tip]](images/tip.svg) | Tip |
|---|---|
|
You can use this feature to regularly baseline your traffic, for example filters such as |