If you see that there is a lot of traffic going out to port 80 (HTTP) on a specific IP address on the internet, you just have to copy the address to your browser and find the website that is most popular with your users. It doesn’t count, for example, the ACK packets, data packets, and so on: This is because Wireshark counts only the packets with the HTTP headers. On the other hand, we see that TCP has 75.70% of the data, and inside TCP, only 12.74% of the packets are HTTP, and that is almost it.For example, in the following screenshot, we see that logical link control has 0.5% of the packets that run over Ethernet, IPv6 has 1.0%, IPv4 has 88.8% of the packets, ARP has 9.6% of the packets and even the old Cisco ISK has 0.1 %-a total of 100 % of the protocols over layer 2 Ethernet. The percentage always refers to the same layer protocols.Simply, it calculates statistics over the captured data. The solution for this problem is to configure a dedicated link between the firewalls so that session tables will not influence the network. Such an amount of packets can severely influence performance. These are synchronization packets that are sent between two firewalls working in a cluster, updating session tables between the firewalls. We see more than 200,000 checkpoint high availability ( CPHA) packets, 74.7% of which are sent over the network we monitored.If IPv6 and DHCPv6 are not required, disable it.

In this file example, we can see two interesting issues:

That is why you see a zero count for Ethernet, IPv4, and UDP end packets there are no frames where those protocols are the last protocol in the frame. These can be TCP packets with no payload (for example, SYN packets) which carry upper layer protocols. The end columns counts when the protocol is the last protocol in the packet (that is, when the protocol comes at the end of the frame).

Wire shark tutorial