This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Basically i'm looking to answer the following question on many large, tracefiles: what value did the ip.dsfield.dscp have for each packet, so i can answer questions as , what percentage of the traffic was in Expedited Forwarding and what in other classes etc. tshark -z would be great to gather these, would it not? Or is there a way to count a certain field in tshark?

asked 16 Sep '15, 12:32

Marc's gravatar image

Marc
147101316
accept rate: 27%


By now , i've read up on some of Sake's Blok and Joke Snelders' work and this looks promising:

tshark -r test.pkt -q -z io,stat,300,COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==48",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==46",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==34",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==32",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==26",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==24",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==18",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==16",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==10",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==8",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==4",COUNT"(ip.dsfield.dscp)ip.dsfield.dscp&&ip.dsfield.dscp==0"

alt text

now lets check if the values found are the right amounts ...

permanent link

answered 17 Sep '15, 08:15

Marc's gravatar image

Marc
147101316
accept rate: 27%

Right, so the values check out, now i've worked it over > 580 traces, got a substantial txt doc,

0.0 <> 118.9 | 5602 | 4024 | 9096 | 0 | 7162 | 0 | 56 | 0 | 0 | 0 | 0 | 1814545 |

did a FIND for 0.0 <> then a copy results to new file in PSPAD, use the | as a delimiter to work it in a spreadsheet .. .. hmm , i might just start marking my own comment as an answer ..

(18 Sep '15, 01:03) Marc
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×23
×7
×5
×3

question asked: 16 Sep '15, 12:32

question was seen: 1,799 times

last updated: 18 Sep '15, 02:44

p​o​w​e​r​e​d by O​S​Q​A