Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] regarding tshark option -z io, stat, COUNT(tcp.analysis.duplic

From: Rikard Svenningsen <wireshark@xxxxxxxxxxxxxx>
Date: Sat, 28 Nov 2009 14:23:20 +0100
Hi
I am trying to use tshark for analysis of some tcp error on my network.
I intent to use the following command:
tshark -r FileToAnalyse -q -z io,stat,120,COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack,COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission

The command: tshark ....... tcp.analysis.retransmission is supposed to be on one line to get it work.
I tried:
-z "io,stat,120,COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission"
and
-z 'io,stat,120,COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission'
and
-z io,stat,120,COUNT\(tcp.analysis.retransmission\)tcp.analysis.retransmission

If I use it just like this:
-z io,stat,120,COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission

I get this:
bash: syntax error near unexpected token `('

Only if I run the command in a DOS prompt in Windows, it will work fine.
-z io,stat,120,COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission


--
Best regards
Rikard Svenningsen
Denmark