Tshark Stats - IP conversations sorted to most bytes?

Question

Right now I am using: tshark -r "C:\Users\admin\Desktop\capture.cap" -qz "conv,ip"

This displays host IP conversations with hosts that have the most frames topping the results. Seems typically the hosts with the most frames usually have the most bytes in their conversations, but not always. Is there anyway to make the hosts with the most bytes in these conversations appear at the top, then descending in value by byte count?

Accepted Answer

Looking at the source, no, the sorting is hard-coded to be by the number of frames.

You could raise an enhancement request to request the functionality.

Answer 2

Try this:

for aa in `ls *.pcap`; do
    echo -------------
    echo ==== $aa ====
    echo "                                               |       <-      | |       ->      | |     Total     |    Relative    |   Duration   |"
    echo "                                               | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |      Start     |              |"
    tshark -r $aa -q -z conv,ip | grep -v -E "====|Conversations|Filter|Total|Frames" | sort -nr -k 9 | head
done

or just

tshark -r file.pcap -q -z conv,ip | grep -v -E "====|Conversations|Filter|Total|Frames" | sort -nr -k 9 | head