Display packet count when using tshark

Question

I'm using dumpcap to capture packets. Typically looks like this:

$ dumpcap -i eth0 -a duration:1 -w test.pcap
Capturing on mon0
File: test.pcap
Packets captured: 63
Packets received/dropped on interface mon0: 63/0 (100.0%)

I put this into a script and would like to save the number of captured packets (63 in the example above) to a file. I can do it by using for example tshark, but that's not what I'm after. Just looking for something like wc -l that gives me the count of captured packets in the pcap file.

Any suggestions? Thanks!

/Z

Answer 1

If you only want the packet count, after dumpcap completes, your script could run "capinfos -Trc test.pcap". If you don't want the filename displayed before the count value, you could further pipe the output to sed to remove the filename using an appropriate substitution string.

Answer 2

Just found the answer myself:

capinfos test.pcap

does the trick!