How to find top talkers in a PCAP or PCAPNG file

A top-talker list quickly identifies the hosts and conversations responsible for most observed traffic. The difficult part is interpreting that list without confusing visibility, duration or legitimate bulk transfers with a fault.

1. Rank endpoints by packets and bytes

In Wireshark, open Statistics → Endpoints, choose the IPv4 or IPv6 tab, and sort by packets, bytes, transmitted bytes or received bytes. “Top” depends on the question: a chatty monitoring agent may lead by packet count while a backup server leads by bytes.

From the command line:

tshark -r capture.pcapng -q -z endpoints,ip
tshark -r capture.pcapng -q -z endpoints,ipv6

Run both when dual-stack traffic is possible. Looking only at IPv4 can hide a significant IPv6 flow.

2. Rank conversations, not just hosts

An endpoint total tells you who is busy; a conversation tells you with whom. Open Statistics → Conversations and inspect Ethernet, IPv4, IPv6, TCP and UDP views. For tshark:

tshark -r capture.pcapng -q -z conv,ip
tshark -r capture.pcapng -q -z conv,tcp
tshark -r capture.pcapng -q -z conv,udp

Compare each direction. A large request followed by a tiny response means something different from a small request followed by a multi-gigabyte transfer. TCP conversation statistics also help separate many short connections from one long bulk flow.

3. Interpret the capture point

The same host can appear very different depending on where you captured:

• A capture outside a NAT gateway may show many clients as one translated address.
• A server-side capture naturally makes the server appear in nearly every flow.
• A SPAN port may omit traffic, duplicate traffic, or drop packets under load.
• Broadcast and multicast packets can inflate receive-side totals across endpoints.
• Truncated packets preserve packet counts but understate bytes.

4. Compare rates when durations differ

Raw bytes are only comparable when captures cover similar periods. Calculate an approximate observed rate:

average bits per second = total bytes x 8 / capture duration

This is an average across the capture, not a peak. Use an I/O graph or interval statistics to reveal short bursts:

tshark -r capture.pcapng -q -z io,stat,1

For before-and-after comparisons, keep the capture location, filter and duration as similar as possible.

5. Turn a top talker into a testable question

Once an address or pair stands out, filter it:

ip.addr == 192.0.2.25
ip.addr == 192.0.2.25 && ip.addr == 198.51.100.8

Then answer: which ports and protocols are involved, when did the traffic begin, is it periodic, is the byte balance expected, are retransmissions or resets present, and which DNS or TLS names connect the IP address to a service? Resolve ownership from authoritative asset data rather than assuming a hostname lookup proves identity.

Manual method vs PCAPNG Analyzer