I noticed that when I filter high speed traffic with tshark from a tcpdump capture file, it will print multiple packets on the same line. For a lot of fields instead of a single value there are multiple values separated by commas.
10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10 10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16 101.7.150.218,101.7.150.244,101.7.151.14,101.7.151.40,101.7.151.66,101.7.151.92,101.7.151.118,101.7.151.144,101.7.151.170,101.7.151.196,101.7.151.222,101.7.151.248,101.7.152.18,101.7.152.44,101.7.152.70,101.7.152.96,101.7.152.122,101.7.152.148,101.7.152.174,101.7.152.200,101.7.152.226,101.7.152.252,101.7.153.22,101.7.153.48 192.168.107.10 192.168.107.12 1419291086.335348000
where every field is separated by one tab.
This data representation is not a big deal since every field is an array and the information about one specific packet can be found by looking at the same index.
Please could you explain why does this happen? Does this mean that the computer is not fast enough and the packets are queued in network interface?
Thank you.
Edit:
OS: ubuntu 14.04
Commnad: sudo tshark -r tmp_capture.pcapng -R "of10.packet_in.type or of10.flow_add.type" -Tfields -e of10.packet_in.type -e of10.flow_add.type -e arp.src.proto_ipv4 -e arp.dst.proto_ipv4 -e of10.match_v1.ipv4_src -e of10.match_v1.ipv4_dst -e ip.src -e ip.dst -e frame.time_epoch
TShark 1.10.6 (v1.10.6 from master-1.10)
asked 23 Dec '14, 02:36
skywalker
11●1●1●3
accept rate: 0%
what is your
I have just updated the question.