This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I ran the following command.. gunzip -c 201509211400.dump.gz | tshark -nr - -Y "tcp.analysis.retransmission" -T fields -e tcp.stream -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e expert.message > table1.txt

13 197.94.235.198 80 152.188.170.15 43372 Retransmission (suspected)

77 443 40383 Retransmission (suspected)

Now i do not understand why there is no IP addresses for tcp streams 77?

I want to count tcp retransmission rate for each connection in my pcap file. I am using following method: The above command will give me all tcp streams with retransmissions. Then i am running following command..

tshark -nr file.pcap -Y "tcp.stream = x" -z conv,"tcp" x = one of the streams given by first command

then rate = ((no. of times x appear in the first command's o/p)/(total line in the conversation i.e second command o/p)) * 100

Is it the right way?

asked 24 Sep '15, 11:53

sahaj's gravatar image

sahaj
6112
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×349
×56
×11

question asked: 24 Sep '15, 11:53

question was seen: 2,917 times

last updated: 24 Sep '15, 11:53

p​o​w​e​r​e​d by O​S​Q​A