Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] tshark load query

From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Mon, 6 Jun 2011 20:37:39 +1000
I have checked in to trunk an enhancement to add LOAD() stats to tshark too.

LOAD() is shown as units of commands.
1.000 represents one I/O  which is different from the GUI graph where
one I/O is represented as 1000



Looks like this:

./tshark -n -r ../captures/smbwrite.cap -z
"io,stat,0.001,LOAD(smb.time)smb.time" -q

...

============================================================================
IO Statistics
Interval:   0.001000 secs
Column #0: LOAD(smb.time)smb.time
                        |    Column #0   |
Time                    |       LOAD     |
0000.000000-0000.001000         1.000000
0000.001000-0000.002000         0.741000
0000.002000-0000.003000         0.000000

...


have fun
ronnie sahlberg

On Mon, Jun 6, 2011 at 4:15 PM, ronnie sahlberg
<ronniesahlberg@xxxxxxxxx> wrote:
> Hmm.   tap-iostat.c for tshark does not support this.
>
> I must have had a private branch I forgot to commit.
>
>
> Ill have a look and see if i can locate it, or else I might just
> reimplement it again.
>
> regards
> ronnie sahlberg
>
>
> On Mon, Jun 6, 2011 at 3:46 AM, j.snelders <j.snelders@xxxxxxxxxx> wrote:
>> Are you referring to the presentation at the Storage Developer Conference
>> 2008:
>> slide 69 -  LOAD graphs?
>>
>> Hopefully Ronnie Sahlberg reads your question...
>> I too like to know the answer.
>>
>> Best regards
>> Joke
>>
>> On Sun, 5 Jun 2011 17:05:27 +0300 Tal Bar-Or wrote:
>>>To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
>>>Subject: Re: [Wireshark-users] tshark load query
>>
>>>Hello j.snelders
>>>
>>>Thanks you for the response , i did looked into the man-pages and saw its
>>>not specified but recently i read RonnieSahlberg Using Wireshark For
>>>Analyzing CIFS
>>>Traffic PDF.
>>>
>>>And in the PDF he gives examples of tshark query and specifying that this
>>>kind of query is possible with tshark "*QUEUE DEPTH analysis can also be
>>>done by tshark*." so this is why i am looking for it
>>>need it for a script that i am writing.
>>>
>>>Thanks
>>>
>>>
>>>On Sun, Jun 5, 2011 at 4:34 PM, j.snelders <j.snelders@xxxxxxxxxx> wrote:
>>>
>>>> Hi Tal Bar-Or,
>>>>
>>>> According to the man-pages this option is only available in Wireshark
>> and
>>>> not in TShark.
>>>>
>>>> http://www.wireshark.org/docs/man-pages/wireshark.html
>>>> "advanced..." If Unit:advanced... is selected the window will display
>> two
>>>> more controls for each of the five graphs. One control will be a menu
>> where
>>>> the type of calculation can be selected from SUM,COUNT,MAX,MIN,AVG and
>>>> LOAD,
>>>> and one control, textbox, where the name of a single display filter field
>>>> can be specified.
>>>>
>>>> http://www.wireshark.org/docs/man-pages/tshark.html
>>>> io,stat can also do much more statistics and calculate COUNT(), SUM(),
>>>> MIN(),
>>>> MAX(), and AVG() using a slightly different filter syntax:
>>>>
>>>>  [COUNT|SUM|MIN|MAX|AVG](<field>)<filter>
>>>>
>>>> My best
>>>> Joke
>>>>
>>>>
>>>>
>>>> >Date: Sun, 5 Jun 2011 14:33:54 +0300 Tal Bar-Or wrote:
>>>> >Hello all,
>>>> >
>>>> >I am trying to produce same query as sown in image with tshark.
>>>> >Please advice
>>>> >
>>>> >Thanks
>>>> >
>>>> >--
>>>> >Tal Bar-or
>>
>>
>>
>>
>>
>> ___________________________________________________________________________
>> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>> Archives:    http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>>
>