Cumulaive Column ip.len value

Question

Hello, Curently it is posible to add Column Cumulative which is giving cumulative value of frame leinght, Is it posible to have Cumulative column but for ip.len value Thank

Answer 1

Nope, unless you write the code that would implement it or get someone else interested to write it. What would be the use case?

You can however do something like this with tshark:

$ tshark -nlr http.cap -T fields -e frame.number -e frame.len -e ip.len -e tcp.len | \
    awk '{frame+=$2;ip+=$3;tcp+=$4;printf("%5d %8d %8d %8d\n",$1,frame,ip,tcp)}' | head
 1       78       64        0
 2      152      124        0
 3      218      176        0
 4      933      877      649
 5      999      929      649
 6     2277     2193     1861
 7     2343     2245     1861
 8     3827     3715     3279
 9     5311     5185     4697
10     5377     5237     4697