Wireshark-users: Re: [Wireshark-users] Capture the time where no troughput is present
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Fri, 10 Jul 2009 07:58:38 +0200
On Fri, Jul 10, 2009 at 10:16:10AM +1000, Ian Schorr wrote:
> 
>    I forgot to mention that if you don't want tshark to actually display any
>    packets (just the stats table), you'll want to feed it a "display filter"
>    that matches no packets.  So you could do something like:
> 
>    tshark -r <file> -R "not frame" -z io,stat,1,"tcp.port==20 or
>    tcp.port==21"  (every packet matches the filter "frame" so a display
>    filter of "not frame" basically says "display any packets")

Actually, that's what the -q option is for :-)

(ie tshark -r <file> -q -z io,stat,1,<filter> )

Cheers,


Sake