Use the command line tool capinfos from the Wireshark suite, sample output:
C:\temp> 'C:\Program Files\Wireshark\capinfos.exe' test.pcapng
File name: test.pcapng
File type: Wireshark/... - pcapng
File encapsulation: Ethernet
Packet size limit: file hdr: (not set)
Number of packets: 13 k
File size: 1957 kB
Data size: 1517 kB
Capture duration: 28 seconds
First packet time: 2015-05-31 16:20:24
Last packet time: 2015-05-31 16:20:52
Data byte rate: 55 kBps
Data bit rate: 440 kbps
Average packet size: 114.41 bytes
Average packet rate: 480 packets/s
SHA1: 96131ed5b7f8ae4583cd7b82bbf6e294435704a6
RIPEMD160: 75cd6e0ae3da1041bb3914fac70abd482fe8e15b
MD5: 95d7eb35fdcb2a27e1afa580a754f39e
Strict time order: True
answered 16 Jul '15, 06:47
grahamb ♦
19.8k●3●30●206
accept rate: 22%
Thanks, then how can i use it for calculating throughput ?
What do you mean by "throughput". The capinfos output has stats such as Data byte rate, Data bit rate, Average packet rate.
Thanks for your reply, I mean, I wanna find a way to calculate the throughput of a PCAP file , So, need a command-line based tool , like this one or tshark , ... if i think right :
Bit rate (simplified) is the number of bits per second required to produce a given level of quality for a given media codec.
Throughput is the rate of transfer one is able to sustain over a data link (which could be between two remote locations through the internet or a data bus internally in a computer).
A pcap file will only tell you what has happened, it can't predict what the maximum rate will be for a given codec.
It sounds as though you are looking for end-to-end connectivity and performance tools, which isn't what Wireshark and the rest of the suite do. The can give you some statistics on what you have captured, but that only relates to the actual traffic captured.
Dear Graham, So you think there is no solution in this manner ? the pcap file are buch of packets that came from a public addreses to my source. and the public address for each pcap is different. Do you think it would be possible to just care about data transffered and time duration ? because i think i should just care about pure data not other packets like header and hanshake and ....
thanks for your support :)
Tshark does have the
-z, ...statistics options that might be more help to you. Have you looked at the tshark man page?Yes, i used it alot for other metrics, but seems throughput is not that much straight. The point is i should care about the amount of data that has been transfered in a period of time. but the file is has more packets like handshake, payload,... and also find out the exact time for data transition. the i can use these two for calculating throughput (If i think right...). It seems t shark will not give me this kind of info or a method for calculation of throughput of a PCAP file. what do you think sir ?
As you still haven't really defined what you mean by "throughput" it's a bit difficult to help you any further.
It seems you are interested in the payload of certain protocols rather than just the total bytes transferred over the length of the pcap file. Can you list which protocols those are?
Dear Graham, I have bunch of PCAP file , and wanna analyse them based on several metrics , i do no have problem with RTT, packet loss, ... But, for throughput it's a bit complicate for me. Yes, you right... I wanna care about the total amount of "DATA" that transferred in unit of time to find out throughput, and probably for accurate measure just should care about data size, not other annoying packets if i right ... i need to extract these info woth command-line because wanna apply it to all the pcap files with a script. The protocol here is TCP.