8.11. Distribution Statistics
Prev | Chapter 8. Statistics | Next

## 8.11. Distribution Statistics

This window allows to write a filter and get a distribution of the values matching this filter, with their respective occurences and percentages. Additionally, an Entropy value (Normalized Shannon) is also computed. Only String, Integer, and IP addresses types are currently supported for the filter.

You can launch it directly from the Statistics menu, then you can type a filter in the edit box, or by a right-click on some field found in the packet details tree, which will display the results for the given clicked field.

Figure 8.10. The “Distribution” window

| Note
A high Entropy value (between 0.9 and 1) indicates that values are rather evenly distributed, while a low value (0 - 0.5) on the contrary indicates one or more dominant values.

| Tip
You can use this feature to regularly baseline your traffic, for example filters such as `frame.protocols` or `ip.geoip.dst_summary` are very useful in some cases and can be compared easily with another capture.

Prev | Up | Next
8.10. Service Response Time | Home | 8.12. DHCP (BOOTP) Statistics