Wireshark-users: [Wireshark-users] tshark iostat calculation
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stuart Kendrick <skendric@xxxxxxxxx>
Date: Sun, 06 Nov 2011 05:23:14 -0800
I would like to sum the delta time between frames which match a filter

In this example, CIFS traffic from a client to a server.

I can do this in the GUI:
Statistics, IO Graphs, Filter tcp.dstport==445, SUM tcp.time_delta, Style FBar, Tick interval 10 min, Unit Advanced


But I'm wanting to use tshark instead.
guru> tshark -nlr sample-cifs.pcap -R "(tcp.dstport==445)" -qz io,stat,600,"SUM
(tcp.time_delta)tcp.time_delta"
===================================================================
IO Statistics
Interval: 600.000 secs
Column #0: SUM(tcp.time_delta)tcp.time_delta
                |   Column #0    
Time            |            SUM 
000.000-600.000                 0 
===================================================================
Clearly, I'm fumbling something.  Suggestions?

--sk

Stuart Kendrick
FHCRC