This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I'm looking for syntax in Wireshark/tshark or any other tool for pcap analyzing for port statistics. I don't know if its possible, but I need to make statistics of port in pcap file. Show statistics by port and display in descending order by occurrence. Calculation will be performed only on Well known ports (0-1023).

Output should be something like:

  • PORT NAME COUNT
  • 80 HTTP 5000
  • 443 HTTPS 500
  • 25 SMTP 80
  • 143 IMAP 70 ....

Thanks a lot

asked 06 Apr '15, 12:56

Eduard%20Woidig's gravatar image

Eduard Woidig
6113
accept rate: 0%

edited 06 Apr '15, 12:59

Hi Eduard - Did you try the Statistics function within Wireshark? In Wireshark, select Statistics from the top menu. Then select Conversations. A window pop-up will be displayed with multiple tabs. You can select TCP. In the TCP tab, you can arrange the amount of traffic in descending order by either bytes or packets. The only limitation on this approach is that each TCP stream (IP-address:TCP-port) is treated separately.

(07 Apr '15, 07:37) Amato_C

C:\Program Files\Wireshark>tshark -i 1 -qz io,stat,5,http,smtp,imap

Capturing on 'Local Area Connection'
4866 packets captured

===============================================================
| IO Statistics                                               |
|                                                             |
| Duration: 29. 30456 secs                                    |
| Interval:  5 secs                                           |
|                                                             |
| Col 1: http                                                 |
|     2: smtp                                                 |
|     3: imap                                                 |
|-------------------------------------------------------------|
|          |1               |2               |3               |
| Interval | Frames | Bytes | Frames | Bytes | Frames | Bytes |
|-------------------------------------------------------------|
|  0 <>  5 |      3 |   525 |      0 |     0 |      0 |     0 |
|  5 <> 10 |      2 |   350 |      0 |     0 |      0 |     0 |
| 10 <> 15 |     11 |  4610 |      0 |     0 |      0 |     0 |
| 15 <> 20 |     75 | 47906 |      0 |     0 |      0 |     0 |
| 20 <> 25 |    137 | 69147 |      0 |     0 |      0 |     0 |
| 25 <> Dur|     28 | 20001 |      0 |     0 |      0 |     0 |
===============================================================

C:\Program Files\Wireshark>
permanent link

answered 08 Apr '15, 10:31

John_Modlin's gravatar image

John_Modlin
1205
accept rate: 0%

edited 08 Apr '15, 10:41

grahamb's gravatar image

grahamb ♦
19.8k330206

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×86
×69

question asked: 06 Apr '15, 12:56

question was seen: 4,027 times

last updated: 08 Apr '15, 10:41

p​o​w​e​r​e​d by O​S​Q​A