This is a static archive of our old Q&A Site. Please post any new questions and answers at

Absolute time in statistics from “tshark -z io,stat”



To get some traffic statistics on multiple capture files in a folder, I am using a batch file running a simple tshark command e.g. "tshark -z io,stat,1,ip.addr==" on each file one after the other, resulting in a large csv file containing the results.

Unluckily, the statistics generated by this command use Relative Time i.e. timestamps start at zero for each new file.

I was wondering why the output time format using tshark –z io,stat cannot be changed from relative to absolute, eg. using “–t ad”. I found on the mailing list a patch for tap-iostat.c which seem to allow such behaviour.

So maybe this question is for devs/advisors, could it be integrated into an upcoming release? Thanks!

asked 16 Apr '12, 09:50

yul_analyzer's gravatar image

accept rate: 0%

One Answer:


I opened bug 7207 to ensure that patch doesn't get lost again. You might want to subscribe yourself to that bug to track its progress.

answered 27 Apr '12, 07:27

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Patch has been applied on trunk and 1.8.0 is now including the corresponding revision, thx!

(05 Jul '12, 12:53) yul_analyzer