This is our old Q&A Site. Please post any new questions and answers at

My goal

Use pre-existing capture files from Wireshark to extract data into a file that can be parsed by Excel or other style process.
Data collection format would be as follows if I was using the online option of IO graph

  • Filter for Graph #1 ip.dst==
  • Filter for Graph #2 ip.dst==

Special settings: Tick interval = 1 or 10 seconds Y axes is measured in Bytes / Ticks view as time of day Select graph 1 and graph 2 buttons Copy data from graph into a text style file.

I am trying to simulate manual interaction with Wireshark IO graph and the capture button.

right now I am using the following:

  • tshark -r myfile -2 -w -R "ip.dst =="
  • tshark -r myfile -2 -w -R "ip.src =="
  • tshark -q -z io,stat,10 -r >
  • tshark -q -z io,stat,10 -r >

The problem is I need wall clock time I would like to simulate the data generated by IO Chart in batch mode that would show Recorded Time, IP=dst, IP=src

I need wall clock time so I can compare results on other activities within the lab. If I could have an output of the first and last entry based on wall time I could re-calc the back into something useful.


Brad M

asked 15 Mar '16, 12:26

Brad%20M's gravatar image

Brad M
accept rate: 0%

sorry about the small error I have in the > of twice

(15 Mar '16, 12:34) Brad M

I have updated my tshark command line after finding additional info

tshark -z io,stat,10,ip.src==,ip.dst== -r myfile >

I am still trying to figure a way to use real time versus ticks.

(15 Mar '16, 12:59) Brad M

After searching thru about 5 years of posts I did come across one option that works

tshark -t ad -q -z io,stat,10,ip.dst=,ip== -nr myfile >

At least now I don't have to wait over 20 mins while playing with Wireshark to just extract performance data for each IP set that I am looking for.

A bit more work in Excel to re-format the data . . . but nothing compared to the time waiting for a laptop to respond to clicks.

permanent link

answered 15 Mar '16, 13:32

Brad%20M's gravatar image

Brad M
accept rate: 0%

edited 15 Mar '16, 13:35

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Mar '16, 12:26

question was seen: 1,154 times

last updated: 15 Mar '16, 13:35

p​o​w​e​r​e​d by O​S​Q​A