This is our old Q&A Site. Please post any new questions and answers at

I am trying to figure how to output what was the bandwidth useage at the time the packets were logged. This is what my command line looks like.

tshark -nr 3.pcap -T fields -E separator=, -E header=y -e frame.number -e frame.time -e frame.len -e eth.type -e eth.src -e eth.dst -e ip.len -e -e ip.flags -e ip.dst -e ip.src -e ip.proto -e ip.ttl >3.csv

What do I need to enter to get bandwidth or do I have make something in excel do it?

asked 03 May '13, 13:11

spanky55amg's gravatar image

accept rate: 0%

More specifically... How do I get bytes? If I can go into Statisitcs > Endpoints> IPv4 and see the bytes, how do I get that from the command line? Total perfered but maybe with Tx and Rx bytes too.

(03 May '13, 13:39) spanky55amg

There is a similar tool in tshark.

tshark -nr data.pcap -z conv,ip -q

That will print a similar overview as the Endpoint statistics (see tshark man page for more statistics options). However it does not print the throughput. As it does print the duration and the amount of bytes it is easy to calculate the throughput. If you need a time series of the throughput, exel or gnuplot are your friends. Plot the fields frame.number and ip.len for a certain stream.


permanent link

answered 03 May '13, 14:16

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 03 May '13, 14:16

I was looking at that too. Thats why I wondered if I could get something like that out on a csv.

(03 May '13, 14:26) spanky55amg

perl/python/lua and/or Excel will extract whatever you need/want from that csv ;-)

(03 May '13, 14:31) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 03 May '13, 13:11

question was seen: 5,088 times

last updated: 03 May '13, 14:31

p​o​w​e​r​e​d by O​S​Q​A