8.4. Conversations

A network conversation is the traffic between two specific endpoints. For example, an IP conversation is all the traffic between two IP addresses. The description of the known endpoint types can be found in Section 8.5.1, “What is an Endpoint?”.

The conversations window is similar to the endpoint Window; see Section 8.5.2, “The "Endpoints" window” for a description of their common features. Along with addresses, packet counters, and byte counters the conversation window adds four columns: the time in seconds between the start of the capture and the start of the conversation ("Rel Start"), the duration of the conversation in seconds, and the average bits (not bytes) per second in each direction.

Figure 8.3. The "Conversations" window

Each row in the list shows the statistical values for exactly one conversation.

Name resolution will be done if selected in the window and if it is active for the specific protocol layer (MAC layer for the selected Ethernet endpoints page).

Limit to display filter will only show conversations matching the current display filter.

The copy button will copy the list values to the clipboard in CSV (Comma Separated Values) format.

	Tip!
	This window will be updated frequently, so it will be useful, even if you open it before (or while) you are doing a live capture.

Before the combined window described above was available, each of its pages was shown as a separate window. Even though the combined window is much more convenient to use, these separate windows are still available. The main reason is that they might process faster for very large capture files. However, as the functionality is exactly the same as in the combined window, they won't be discussed in detail here.