This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can SMB QUEUE DEPTH analysis also could be done by tshark?

0

Hi All

I am looking into SMB QUEUE DEPTH analysis with tshark. i know hot get smb.time statistics "tshark -nlr c:smb.pcap -qz io,stat,10,"COUNT(smb.time)smb.time","MIN(smb.time)smb.time","AVG(smb.time)smb.time","MAX(smb.time)smb.time" but i can't find the right query for LOAD Please advice Thanks

asked 04 Jun '11, 12:03

tbaror's gravatar image

tbaror
10●12●12●15
accept rate: 0%

anyone? LOAD(smb.time)smb.time

(05 Jun '11, 02:35) tbaror
2

See thread at Wireshark User's list.

(06 Jun '11, 00:45) joke

One Answer:

3

QUEUE DEPTH analysis can now be done by tshark.
Thanks to Ronnie Sahlberg. He has checked in an enhancement to add LOAD() stats to tshark.

Download Wireshark version 1.6.0 and run this command:

$ tshark -r test.pcap -qz "io,stat,360,LOAD(smb.time)smb.time"
===================================================================
IO Statistics
Interval: 360.000 secs
Column #0: LOAD(smb.time)smb.time
                |   Column #0
Time            |           LOAD
000.000-360.000       462.096794
360.000-720.000       100.718411
720.000-1080.000        96.485666
1080.000-1440.000        35.952216
1440.000-1800.000        80.976688
1800.000-2160.000         8.415044

answered 08 Jun '11, 21:46

joke's gravatar image

joke
1.3k●4●9●34
accept rate: 9%

thanks :-)

(09 Jun '11, 01:41) tbaror