This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Packet Size

Hi Team

I want to Know what is the packet size of the packets captured in the wireshark trace. can you please also confirm is there any way to see the statical way to see how the packets on the Packet size basis.

Regards Ankit Jain

ankit

asked 16 Aug '12, 04:53

Ank1t Ja1n
1●1●1●1
accept rate: 0%

3 Answers:

0	Sure, just go to Statistics -> Packet Length for a statistics on packet length in the current trace. You can just leave the filter setting empty if you want the values for the complete file. answered 16 Aug '12, 05:46 Jasper ♦♦ 23.8k●5●51●284 accept rate: 18%

0	There is also the capinfos tool. That gives average packet size and bit/byte/packet rates among other stats. answered 16 Aug '12, 05:59 grahamb ♦ 19.8k●3●30●206 accept rate: 22%

and finally, there is tshark.

tshark -nr input.cap -T fields -E header=y -E separator=; -e frame.time -e frame.time_epoch -e frame.len -e ip.len -e tcp.len > packet_size.csv

You can also use a display filter (-R) to narrow down what you need.

tshark -nr input.cap -R "tcp.port eq 80" -T fields -E header=y -E separator=; -e frame.time -e frame.time_epoch -e frame.len -e ip.len -e tcp.len > packet_size.csv

Then use MS Excel to create a histogram of the packet sizes (or whatever you need), based on the CSV data.

Regards
Kurt

answered 16 Aug '12, 06:43

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 16 Aug '12, 06:47