What is the Protocol Hierarchy view used for in Wireshark?

• A. It filters HTTP requests by status codes.
• B. It shows the distribution of traffic across protocols, helping identify dominant protocols and anomalies.
• C. It displays per-session TCP metrics.
• D. It exports HTTP objects to disk.

Answer: (B)

You use the Protocol Hierarchy view to see how traffic in the capture is distributed across different protocols. It provides a hierarchical summary—usually with counts and percentages for each protocol and subprotocol—so you can quickly see which protocols dominate the traffic and where any unusual or unexpected protocols appear. This high-level glimpse helps you prioritize where to dig deeper, spot anomalies, and understand the overall protocol mix in the capture.

This view isn’t about filtering HTTP by status codes, which would require a specific display filter. It also isn’t focused on per-session TCP metrics, which come from TCP-specific analyses like conversations or stream graphs. And it doesn’t export HTTP objects to disk, which is done via the Export Objects feature.