ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] tshark io,stat usage

From: Florent Deybach <fdeybach@xxxxxxxxxxxxxx>
Date: Tue, 14 Apr 2009 15:33:14 +0200
Hello,

I am trying to use tshark to generate statistics using the AVG, SUM,
etc... functions.
I am not able to use the filter parameter, i.e.:

The following commands :

$tshark -r D:\capture-00033.pcap -qz io,stat,30,AVG(frame.pkt_len)frame.pkt_len
and
$tshark -r D:\capture-00033.pcap -qz io,stat,30

give me the same output:

===================================================================
IO Statistics
Interval: 30.000 secs
Column #0:
                |   Column #0
Time            |frames|  bytes
000.000-030.000  222841  61137025
030.000-060.000    9155   2257762
===================================================================

In fact, I can put whatever I want in the filter parameter, I always
get the same output as if the parameter isn't set....

For example with the parameter
-z io,stat,1,ip.addr==1.2.3.4
I get the same output as without it (and the IP is a fake, it should
give me no stats...): -z io,stat,1

What did I wrong ??

Thanks,

Florent