Right now I am using: tshark -r "C:\Users\admin\Desktop\capture.cap" -qz "conv,ip"
This displays host IP conversations with hosts that have the most frames topping the results. Seems typically the hosts with the most frames usually have the most bytes in their conversations, but not always. Is there anyway to make the hosts with the most bytes in these conversations appear at the top, then descending in value by byte count?
asked 23 Feb '16, 10:24
answered 14 Jul '17, 15:09
edited 15 Jul '17, 05:30