Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] tethereal io,stat disregard filtering

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Daniel D'Avignon-Aubut (QC/EMC)" <daniel.davignon-aubut@xxxxxxxxxxxx>
Date: Mon, 11 Apr 2005 10:13:41 -0500
Title: tethereal io,stat disregard filtering

Hi,

I try to generate statistics for a huge amount of log files (aroung 40 Gb in multiple files).

I would like to have the io stat for different criterias (multiple filters) with the numbers of frames for each.  This is clearly explained as possible in the man page using -z io,stat,interval[,filter][,filter][,filter].  There should be one column for each filter.  However, the filters are disregarded and I always get a single column, the total of all packets.

I installed the latest ethereal version 0.10.10 (previous version: 0.10.5) and I have the same behaviour.

I searched on the web to see if it was a known bug and found nothing.

Below, you can find the commands I use and the output is always the same.  I'm pretty sure I use the right filters (read filters).

Ca anyone shed some light on this behaviour?

Thanks,

Example output:
No filter.  This is ok.
root@Monitor:/mnt/sda1/tethereal# tethereal -r capture.small.14h253 -z io,stat,10 -q

===================================================================
IO Statistics
Interval: 10.000 secs
Column #0:
                |   Column #0   
Time            |frames|  bytes 
000.000-010.000   22999  10788267
010.000-020.000   24456  11378156
020.000-030.000   23455  10643635
030.000-040.000   23527  10598430
040.000-050.000   22598  10480757
050.000-060.000   13051   6049494
060.000-070.000   14089   6496627
070.000-080.000   19168   8340873
080.000-090.000   22758  10353743
090.000-100.000   21706  10012573
100.000-110.000   22746  10608688
110.000-120.000   23073  10768920

#filter the m.send.req and m.retrieve.conf only.
#same output.  This is wrong...
root@Monitor:/mnt/sda1/tethereal# tethereal -r capture.small.14h253 -z io,stat,10,mmse.message_type==0x81,mmse.message_type==0x83 -q

===================================================================
IO Statistics
Interval: 10.000 secs
Column #0:
                |   Column #0   
Time            |frames|  bytes 
000.000-010.000   22999  10788267
010.000-020.000   24456  11378156
020.000-030.000   23455  10643635
030.000-040.000   23527  10598430
040.000-050.000   22598  10480757
050.000-060.000   13051   6049494
060.000-070.000   14089   6496627
070.000-080.000   19168   8340873
080.000-090.000   22758  10353743
090.000-100.000   21706  10012573
100.000-110.000   22746  10608688
110.000-120.000   23073  10768920

#filter with ip adresses!  I've hidden them, but those are right ip adresses...
#still the same output
root@Monitor:/mnt/sda1/tethereal# tethereal -r capture.small.14h253 -z io,stat,10,ip.addr==10.XXX.XXX.XXX,ip.addr=10.XXX.XXX.XXX -q

===================================================================
IO Statistics
Interval: 10.000 secs
Column #0:
                |   Column #0   
Time            |frames|  bytes 
000.000-010.000   22999  10788267
010.000-020.000   24456  11378156
020.000-030.000   23455  10643635
030.000-040.000   23527  10598430
040.000-050.000   22598  10480757
050.000-060.000   13051   6049494
060.000-070.000   14089   6496627
070.000-080.000   19168   8340873
080.000-090.000   22758  10353743
090.000-100.000   21706  10012573
100.000-110.000   22746  10608688
110.000-120.000   23073  10768920

/Daniel