How can you identify the top talkers in a capture?

• A. Use Statistics > Conversations or Endpoints and sort by bytes or packets to see the largest communicators.
• B. Follow TCP Stream to identify top talkers.
• C. Export Objects > HTTP to export top talkers.
• D. IO Graphs to identify top talkers.

Answer: (A)

The main idea is to quantify who is talking the most in the capture by looking at per-communication statistics. In Wireshark, you can open Statistics > Conversations to see each pair of endpoints and the total data exchanged, or Statistics > Endpoints to see activity per host. Sorting by bytes shows which communicators transferred the most data, while sorting by packets highlights who sent or received the most packets. This ranking directly reveals the top talkers in the capture.

The other tools don’t directly identify top talkers. Following a TCP stream reconstructs a single flow, which is useful for inspecting that session but doesn’t summarize all participants’ activity. Exporting HTTP objects lists individual objects, not the overall communication volume by host. IO Graphs visualize traffic over time, useful for spotting bursts or trends but not for ranking which hosts talk the most.