This is our old Q&A Site. Please post any new questions and answers at

Wireshark has this option to filter the scsi response time where as tshark doesn't has this commandline argument option at all. Is there anything I'm missing

-z scsi,srt,cmdset[,<filter>]

Wireshark has this feature where as tshark doesn't has this commandline option at all.

asked 19 Mar '11, 12:27

asif's gravatar image

accept rate: 0%

edited 19 Mar '11, 15:20

SYN-bit's gravatar image

SYN-bit ♦♦

FYI: For consistency between tshark and Wireshark, starting with 1.5.1 (whenever it is released), the syntax of the "-z <proto>,rtt" option will be changed to match Wireshark's syntax of "-z <proto>,srt". This is also true of the automated releases as of revision 36297. Automated releases are available from:

(25 Mar '11, 06:58) cmaynard ♦♦

Which version are you using?
$ tshark -v
TShark 1.5.0 (SVN Rev 35637 from /trunk)

Download the Development release (1.5.0) or an automated build.

According to the man-page you should use "-z scsi,srt,cmdset[,filter]", but I get an error:

$ tshark -r test.pcap -q -z scsi,srt,0
tshark: invalid -z argument.
  -z argument must be one of :

Try this:
Wireshark Wiki: Sample Captures - fcoe-drop-rddata.cap

$ tshark -r fcoe-drop-rddata.cap -q -z scsi,rtt,0
SCSI SBC (disk) RTT Statistics:
Procedure            Calls   Min RTT    Max RTT    Avg RTT
Read(6)                  2   0.039798   0.087864   0.063831

permanent link

answered 19 Mar '11, 13:12

joke's gravatar image

accept rate: 9%

edited 19 Mar '11, 15:53

I've downloaded the latest stable build which is 1.4.4. Let me try the build you have pointed out. Thanks for the quick response.

(19 Mar '11, 13:44) asif

(converted your "answer" to a "comment" to follow the Q&A style of this site, please see the FAQ for more information)

(19 Mar '11, 15:21) SYN-bit ♦♦

Installed the 1.5.0 build and I see scsi,rtt commandline arguments. There is a difference in the output compared to UI. Is this a known issue?

Via CLI started the capture trace: - tshark -S -i 2 -w capture_out.pcap - tshark -r capture_out.pcap -q -z scsi,rtt,0

returns avg SRT value: 0.021678.

Via UI capture, I get the avg SRT value: 0.081465.

Which avg SRT is correct? Yes, I've made sure I start the capture trace first before i send data.

Any help is appreciated.

(20 Mar '11, 11:13) asif

FYI: This last question about the difference in tshark vs. Wireshark output was re-asked and answered here:

(25 Mar '11, 07:22) cmaynard ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Mar '11, 12:27

question was seen: 3,935 times

last updated: 25 Mar '11, 07:22

p​o​w​e​r​e​d by O​S​Q​A