Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] tshark statistics locales pitfall

From: Jochen Miroll <jochen.miroll@xxxxxx>
Date: Sun, 25 Feb 2007 14:52:36 +0100
Hi,

I would like to bring a problem to attention which I encountered using
the statistics feature of tshark (-z io,stat option).

Even the simple example from the man page,
   -z io,stat,1,ip.addr==1.2.3.4
will not work if you have a locales setting where the decimal point
is a comma instead of a dot. What happens is that the comma after the
time value "1" is interpreted as the decimal point, which will not
work, so the rest of the filter string is omitted.

Another example would be writing
   -z io,stat,0.001,ip.addr==1.2.3.4
where tshark will complain that the time value must be >= 0.001, but in
this case it is 0.001 (one might think).

On the other hand the output of tshark does not depend on the current locales setting. The dot is always used as the decimal point. This is a bit inconsistent.

I think it could be stated in the man page that the time
parameter expects a time value in your local time format.

Best regards,
Jochen.