This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Cumulaive Column ip.len value

0

Hello, Curently it is posible to add Column Cumulative which is giving cumulative value of frame leinght, Is it posible to have Cumulative column but for ip.len value Thank

asked 10 Mar '11, 09:27

lavpivolav's gravatar image

lavpivolav
1222
accept rate: 0%


One Answer:

1

Nope, unless you write the code that would implement it or get someone else interested to write it. What would be the use case?

You can however do something like this with tshark:

$ tshark -nlr http.cap -T fields -e frame.number -e frame.len -e ip.len -e tcp.len | \
    awk '{frame+=$2;ip+=$3;tcp+=$4;printf("%5d %8d %8d %8d\n",$1,frame,ip,tcp)}' | head
 1       78       64        0
 2      152      124        0
 3      218      176        0
 4      933      877      649
 5      999      929      649
 6     2277     2193     1861
 7     2343     2245     1861
 8     3827     3715     3279
 9     5311     5185     4697
10     5377     5237     4697

answered 10 Mar '11, 09:48

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%