This is our old Q&A Site. Please post any new questions and answers at

I know that by doing

tshark -r pcap.pcap -qz conv,tcp

I can read all the TCP flows but I would like to see specifically the number of flows that exist on a pcap file. I do not want to do that through wc -l because I am not sure if the output is always similar and whether additional lines will be added.

asked 28 Jan '16, 07:55

altdrugzgene's gravatar image

accept rate: 0%

Maybe use the fields option and directly output the field, then post-process that to find the highest unique value, e.g. using PowerShell:

tshark -r pcap.pcap -T fields -e | foreach{ [int]$_ + 1 } | SortObject -Unique -Descending | Select-Object -First 1

Basically sort the stream integers into descending order, omitting duplicates, then select the first 1 (or head).

Note that this will give a 0-based index of the streams, to get the actual stream count you still have to add 1.

Update: Added coercion to int to fix numeric sort, plus an offset to make the numbers 1 based and the resulting count accurate.

permanent link

answered 28 Jan '16, 08:15

grahamb's gravatar image

grahamb ♦
accept rate: 22%

edited 28 Jan '16, 09:47

Thanks for your reply. Interestingly from the first piece tshark -r pcap.pcap -T fields -e I am getting 53 as the largest however I noticed that there are 54 flows! Is it starting counting from 0 ? I am using linux btw so no powershell for me! :P

(28 Jan '16, 08:29) altdrugzgene

Note the last bit of my answer about the stream field being 0-based.

In bash you should be able to run ... | sort -ur | head -1

(28 Jan '16, 08:46) grahamb ♦

This returns totally wrong number.. dunno why

(28 Jan '16, 08:58) altdrugzgene

Add -g to the sort parms to make it a numeric sort?

(28 Jan '16, 09:20) grahamb ♦

sweet that worked.. still have to get the first entry with -g though. I thought it would be possible to get it from tshark itself but ok. Cheers and Thanks

(28 Jan '16, 09:27) altdrugzgene
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Jan '16, 07:55

question was seen: 3,884 times

last updated: 28 Jan '16, 09:47

p​o​w​e​r​e​d by O​S​Q​A