In the following version...
TShark 1.10.7 (v1.10.7-0-g6b931a1 from master-1.10)
Is this expected?
Why is there such a difference in counts and what should it be?
asked 30 May ‘14, 12:52
edited 30 May ‘14, 13:46
because you are using -q (be quiet) in the first case, which tells tshark to not print a line for every packet in the capture file. As you did not use -q in the second case, you are getting a much larger number of lines, one per frame in the pcap file. That's totally expected behavior. See the man page of tshark.
answered 31 May '14, 07:19
Kurt Knochner ♦