top of page
  • Writer's pictureLaura Chappell

Quickly Add IO Graph Items in Wireshark

Updated: Apr 19

This is a quick tip that you'll love.


By default, Wireshark's IO Graph depicts the packets per second rate of all traffic and "Bad TCP" traffic (we'll discuss that next week).


Did you know that any display filter that you prepare/apply is automatically added as another packets-per-second line on your IO Graph? By default, this new line is also marked active.


In the gif example, I'm looking for IP headers that contain an option field. The display filter is ip.hdr_len > 20.* When I select Statistics > IO Graphs, I see a new graph line has been created based on that display filter.


Add display filter and it appears in io graph

Your new graph item will appear as "Filtered packets" directly below any other graph lines in place.


Once you've changed the IO graph, Wireshark saves your settings in the io_graphs file that is inside your profile directory.


io_graph sample

Want to share a cool IO graph with someone else? Just send them your io_graphs file!

(Note: You can only have one io_graphs file in each profile directory.)


Cheers!


For @ErrataRob - here's a trace where the IP headers use an option, Router Alert, matching the ip.hdr_len > 20. From my Windows 11 host.



Comments


bottom of page