Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: [Ethereal-dev] PATCH - Allow editcap to report # of packets in file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ian Schorr <ethereal@xxxxxxxxxxxxx>
Date: Tue, 27 Jul 2004 01:40:13 -0400
Last one today:

Allows user to throw a -c command-line option that instructs editcap to return the number of packets in a file to stdout.

I find this very useful when needing to count packets from scripts and other things. It's much, MUCH faster than "tethereal -r <file> -R 'frame' | wc -l" and doesn't require rewriting the entire trace as does "editcap -v -r 'trace1' 'temptrace' 1-100000000 | wc -l". (Also doesn't require wc or similar programs not necessarily available on all platforms).

If this is going to be checked in then I'll go ahead and submit a patch for the editcap pod.

Ian


--- editcap.c	2004-07-27 01:29:35.242803200 -0400
+++ editcap.c.new	2004-07-27 01:31:13.444009600 -0400
@@ -268,15 +268,58 @@
   time_adj.tv.tv_usec = val;
 }
 
+/* Count and print the number of packets in the file */
+static void packet_count(const char *in_file)
+{
+  wtap	*wth;
+  int         err;
+  gchar      *err_info;
+  int		packet = 0;
+  long	data_offset = 0;
+
+  wth = wtap_open_offline(in_file, &err, &err_info, FALSE);
+
+  if (!wth) {
+    fprintf(stderr, "editcap: Can't open %s: %s\n", in_file,
+        wtap_strerror(err));
+
+    switch (err) {
+
+    case WTAP_ERR_UNSUPPORTED:
+    case WTAP_ERR_UNSUPPORTED_ENCAP:
+    case WTAP_ERR_BAD_RECORD:
+      fprintf(stderr, "(%s)\n", err_info);
+      g_free(err_info);
+      break;
+    }
+    exit(1);
+  }
+
+  while ( (wtap_read(wth, &err, &err_info, &data_offset)) ) {
+      packet++;
+	}
+
+  if (err != 0) {
+      fprintf(stderr, "Error after reading %i packets\n", packet);
+	exit(1);
+  }
+
+  wtap_close(wth);
+
+  printf("%i", packet);
+}
+
 static void usage(void)
 {
   int i;
   const char *string;
 
-  fprintf(stderr, "Usage: editcap [-r] [-h] [-v] [-T <encap type>] [-F <capture type>]\n");
+  fprintf(stderr, "Usage: editcap [-c] <infile>\n");
+  fprintf(stderr, "       editcap [-r] [-h] [-v] [-T <encap type>] [-F <capture type>]\n");
   fprintf(stderr, "               [-s <snaplen>] [-t <time adjustment>]\n");
   fprintf(stderr, "               <infile> <outfile> [ <record#>[-<record#>] ... ]\n");
-  fprintf(stderr, "  where\t-r specifies that the records specified should be kept, not deleted, \n");
+  fprintf(stderr, "  where\t-c counts the number of packets in <infile>\n");
+  fprintf(stderr, "       \t-r specifies that the records specified should be kept, not deleted, \n");
   fprintf(stderr, "                           default is to delete\n");
   fprintf(stderr, "       \t-v specifies verbose operation, default is silent\n");
   fprintf(stderr, "       \t-h produces this help listing.\n");
@@ -317,10 +360,15 @@
 
   /* Process the options first */
 
-  while ((opt = getopt(argc, argv, "T:F:rvs:t:h")) !=-1) {
+  while ((opt = getopt(argc, argv, "cT:F:rvs:t:h")) !=-1) {
 
     switch (opt) {
 
+    case 'c':
+      packet_count(argv[optind]);
+	exit(1);
+      break;
+
     case 'T':
       out_frame_type = wtap_short_string_to_encap(optarg);
       if (out_frame_type < 0) {