Which Wireshark feature helps analyze protocol distribution in a capture?

• A. Graphing options
• B. Protocol Hierarchy
• C. Filter expression builder
• D. Color rules

Answer: (B)

Understanding how traffic is spread across different protocols is vital for quickly assessing what the capture contains and where to look for issues. The Protocol Hierarchy statistic in Wireshark provides that distribution in a clear, stacked view: it shows each protocol, how many packets (and sometimes bytes) belong to it, and the relative percentage of the total capture. Because it organizes protocols in a tree, you can see both the broad layers (like DNS, HTTP, TLS) and the subprotocols riding on top of them, giving you a quick map of what’s dominating the traffic and how it’s nested.

You can access it from Statistics > Protocol Hierarchy, and expand nodes to drill down into subprotocols. This helps identify which protocols are carrying most of the traffic and spot anomalies or unexpected services quickly, guiding further filtering and inspection.

Other features serve different purposes: Graphing options create time-based charts of traffic or protocol activity, which illustrate trends rather than a static distribution; the Filter expression builder is for crafting search filters to isolate packets; color rules change visual highlighting but don’t summarize protocol usage. The Protocol Hierarchy view specifically delivers the distribution snapshot you need.