Guides / Top talkers

How to find top talkers in a PCAP or PCAPNG file

A top-talker list quickly identifies the hosts and conversations responsible for most observed traffic. The difficult part is interpreting that list without confusing visibility, duration or legitimate bulk transfers with a fault.

By Stuart Mathieson7 minute readWireshark + tsharkUpdated 12 October 2026
The quick way

Upload the capture and PCAPNG Analyzer shows the top talkers and conversations, traffic over time and the protocol mix on one page, and any conversation opens as a stream. In Pro, click an address to see every capture it has appeared in; first-seen findings flag hosts your network has never talked to before.

Just one capture to check? The free PCAP Toolkit shows its top talkers, busiest conversations, protocol mix and traffic over time in your browser, without uploading the file.

See a sample report →
In this guide
  1. Rank endpoints
  2. Rank conversations
  3. Interpret the result
  4. Narrow the investigation
  5. Manual vs automated workflow

1. Rank endpoints by packets and bytes

In Wireshark, open Statistics → Endpoints, choose the IPv4 or IPv6 tab, and sort by packets, bytes, transmitted bytes or received bytes. “Top” depends on the question: a chatty monitoring agent may lead by packet count while a backup server leads by bytes.

From the command line:

tshark -r capture.pcapng -q -z endpoints,ip
tshark -r capture.pcapng -q -z endpoints,ipv6

Run both when dual-stack traffic is possible. Looking only at IPv4 can hide a significant IPv6 flow.

2. Rank conversations, not just hosts

An endpoint total tells you who is busy; a conversation tells you with whom. Open Statistics → Conversations and inspect Ethernet, IPv4, IPv6, TCP and UDP views. For tshark:

tshark -r capture.pcapng -q -z conv,ip
tshark -r capture.pcapng -q -z conv,tcp
tshark -r capture.pcapng -q -z conv,udp

Compare each direction. A large request followed by a tiny response means something different from a small request followed by a multi-gigabyte transfer. TCP conversation statistics also help separate many short connections from one long bulk flow.

3. Interpret the capture point

The same host can appear very different depending on where you captured:

Busy does not mean bad.

Backups, replication, package mirrors and video distribution are expected top talkers in many environments. Use ownership, time of day, destination and protocol before assigning risk.

4. Compare rates when durations differ

Raw bytes are only comparable when captures cover similar periods. Calculate an approximate observed rate:

average bits per second = total bytes x 8 / capture duration

This is an average across the capture, not a peak. Use an I/O graph or interval statistics to reveal short bursts:

tshark -r capture.pcapng -q -z io,stat,1

For before-and-after comparisons, keep the capture location, filter and duration as similar as possible.

5. Turn a top talker into a testable question

Once an address or pair stands out, filter it:

ip.addr == 192.0.2.25
ip.addr == 192.0.2.25 && ip.addr == 198.51.100.8

Then answer: which ports and protocols are involved, when did the traffic begin, is it periodic, is the byte balance expected, are retransmissions or resets present, and which DNS or TLS names connect the IP address to a service? Resolve ownership from authoritative asset data rather than assuming a hostname lookup proves identity.

Manual method vs PCAPNG Analyzer

Manual method

  1. Open Endpoint statistics.
  2. Sort by packets, bytes and direction.
  3. Open Conversation statistics.
  4. Filter the busiest relevant pair.
  5. Inspect its protocols, timing and stream context.

With PCAPNG Analyzer

  1. Upload the capture.
  2. Read the top source and destination addresses and the conversation summary, and follow any conversation as a stream.
  3. In Pro, click an address for its history across captures, and check first-seen findings for new hosts.
What the report adds

Protocols, talkers, conversations and traffic over time sit together on one page, and any conversation can be followed as a stream. With Pro, history adds what a single capture can’t: each address’s timeline across your captures, and first-seen findings for new hosts. For inspecting arbitrary protocol fields, Wireshark remains the tool.

Related guides

See talkers and conversations in one report

Analyse captures in a browser while keeping the packet data on your own computer or server.

Download freeView sample report