To be more precise:

C:\Program Files\Wireshark>tshark -v

TShark 1.1.3 (SVN Rev 27807)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.

This is free software; see the source for copying conditions. There is NO

warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.20.0, with WinPcap (version unknown), with libz 1.2.3,

without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8, with c-ares 1.6.0,

with Lua 5.1, with GnuTLS 2.6.4, with Gcrypt 1.4.4, with MIT Kerberos, with

GeoIP.

Running on Windows XP Service Pack 2, build 2600, with WinPcap version 4.0.2

(packet.dll version 4.0.0.1040), based on libpcap version 0.9.5, GnuTLS 2.6.4,

Gcrypt 1.4.4.

Built using Microsoft Visual C++ 9.0 build 30729

Hi,

Does some one know why the following command: “Tshark.exe –r testfile.pcap –q –z io,stat,30,COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission” outputs this:

C:\Program Files\Wireshark>tshark.exe -r update.pcap -q -z io,stat,30,COUNT(tcp.

analysis.retransmission)cp.analysis.retransmission

===================================================================

IO Statistics

Interval: 30.000 secs

Column #0:

                |   Column #0

Time            |frames|  bytes

000.000-030.000       2       444

030.000-060.000       1       222

060.000-090.000       1       222

090.000-120.000      17      3081

120.000-150.000   23676  22054026

150.000-180.000   39681  37077760

180.000-210.000   88041  83327179

210.000-240.000   86237  81549459

240.000-270.000   43381  40256634

270.000-300.000    8147   7507780

300.000-330.000       2       472

330.000-360.000       3       348

360.000-390.000       1       222

390.000-420.000       1       222

420.000-450.000       2       314

Instead of a column with the counted tcp retransmissions?

Got the same result with :

tshark.exe –r testfile.pcap” –q –z io,stat,30,”COUNT(tcp.analysis.retranmission)tcp.analysis.retransmission”,”AVG(tcp.window_size)tcp.window_size”,”MAX(tcp.window_size)”,”MIN(tcp.window_size)tcp.window_size”


I am using TShark 1.1.3 (SVN Rev 27807) .

(testfile.pcap does contain tcp and retransmission so its not that)

Kind regards,

                    Jo