Basically I'm trying to get a total amount of bytes transferred per port (22, 5900, 5901, etc) but tshark does not seem to give the same results as wireshark... what am I doing wrong? I've tested this with wireshark/tshark 1.12.5 on win7 and tshark 1.10.6 on Ubuntu linux, same results. All tests reading from the same pcap file.
I added "Cumulative Bytes" as a column then applied a filter: "tcp.port==22". Cumulative bytes at the bottom for this filter is 396974.
Tshark gives me 71578 bytes from the same data:
Using tshark, how can I get a statistical dump of the total tx/rx bytes per port (tcp.port) from the entire file based on a list of ~ 20 specific ports ? (it would be lot faster then running wireshark filters manually then copying the last "Cumulative Bytes" value each time)
asked 19 May '15, 13:19
edited 19 May '15, 16:05
In general it works (same values in the GUI and tshark). I just tested with 1.12.1 on Win7. So, the problem could be related to your capture file.
Can you please test with the following test file to see if you get the same result as I do.