Wireshark-users: Re: [Wireshark-users] data volume in a transmisison

From: j.snelders@xxxxxxxxxx
Date: Mon, 12 Jan 2009 20:29:10 +0100

Hi Tom

Wireshark:
Apply a display filter: 
frame.time_relative >= 17 && frame.time_relative <= 34

Go to Statistics -> Summery.
You'll get een overview of the captured and the displayed packets, for instance
the bytes.


TShark:
You can use TShark to display statistics. 

tshark -r test.pcap -q -z io,stat,100,SUM(frame.len)frame.len
Output:
===================================================================
IO Statistics
Interval: 100.000 secs
Column #0: SUM(frame.len)frame.len
                |   Column #0
Time            |            SUM
000.000-100.000            369576
100.000-200.000             82081
200.000-300.000            546575
300.000-400.000           5652899
400.000-500.000           8656673
500.000-600.000              1061
===================================================================

Man pages:
http://www.wireshark.org/docs/man-pages/tshark.html

Hope this helps
Joan


On Mon, 12 Jan 2009 16:24:56 +0100 Tom Mayer wrote:
>hi,
>
>i have a dump of a communication btween two computers. i now need to find
>out how much traffic (in bytes/MB) went over the line between two point
in
>time, lets say, how much MB the packets between 17 seconds and 34 seconds
>are altogether. can wireshark do this?
>
>cheers
>Tom
>-- 
>Psssst! Schon vom neuen GMX MultiMessenger geh?rt? Der kann`s mit allen:
>http://www.gmx.net/de/go/multimessenger
>___________________________________________________________________________
>Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>Archives:    http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe