Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] tethereal stats

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Glenn Newell" <Glenn.Newell@xxxxxxxxxxxx>
Date: Mon, 11 Jul 2005 12:22:00 -0700
Hi,

I'm writing a script to check NFS response suing tethereal.

basically, it captures the output of df, to find what nfs servers are in
use, does a capture with tethereal, then goes through a loop:

	foreach $record ( sort keys %NfsServers ) {
		print "$record --------------------------------\n";

		@results = `tethereal -q -r /tmp/$$.ethereal -z
rpc,rtt,100003,3,\"ip.addr eq $record\" -z io,stat,100,\"ip.addr eq
$record\"`;
		print "@results\n";

		}


Some Questions:

1) I would like to get per nfs server output to -z rpc,programs, but it
doesn't take capture filters, and display filters don't seem to do
anything. How can I get per nfs server rpc, programs without taking a
different capture per server, or being swamped with the detail of each
rpc,rtt?

2) I would like to get per nfs server bandwidth output, similar to the
summary page in ethereal or the capinfo output, but capinfo doesn't take
capture filters either. I can do math on the output of io,stat but would
prefer direct output. Suggestions?

3) As discussed on http://wiki.ethereal.com/TcpPduTime TcpPduTime is a
good way to check for TCP retransmit issues, but tethereal doesn't
support it. How can I get a count of TCP retransmits (or other
indications of problems beyond SRT/RTT) from tethereal? I tried:
-z io,stat,6400,COUNT(tcp.analysis.flags), because you can use
tcp.analysis.flags in ethereal to turn retransmit packets red (see above
wiki page), but even on traces with red packets in ethereal the count
output is zero in tethereal.

Thanks,
Glenn