This is our old Q&A Site. Please post any new questions and answers at

I have a tshark trace dump and want to see the human readable time stamps between NFS READ procedure calls/packets. I understand frame.time_delta might be a good filter expression?

Can anyone provide a command line example on how to do this running tshark. I have the RTT stats and READ procedure has very heavy latency so I want to drill down and see if I can understand which file handle(s) might be responsible.

Any help is very much appreciated.


asked 26 Jan '11, 18:04

debugme's gravatar image

accept rate: 0%


Thank you for your response. I will use your filter and see what the results are. Thank you again.

(07 Feb '11, 09:49) debugme

I used the following before to get a grasp on which NFS calls were taking a lot of time:

tshark -o tcp.desegment_tcp_streams:FALSE -nlr nfs.cap -R rpc -qzio,stat,300,\

If you want to drill down, you might want to use something like:

tshark -nlr nfs.cap -R "rpc.time>0.5"
permanent link

answered 27 Jan '11, 10:37

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Jan '11, 18:04

question was seen: 3,798 times

last updated: 07 Feb '11, 09:49

p​o​w​e​r​e​d by O​S​Q​A