This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

My goal

Use pre-existing capture files from Wireshark to extract data into a file that can be parsed by Excel or other style process.
Data collection format would be as follows if I was using the online option of IO graph

  • Filter for Graph #1 ip.dst==10.0.2.15
  • Filter for Graph #2 ip.dst==10.0.2.15

Special settings: Tick interval = 1 or 10 seconds Y axes is measured in Bytes / Ticks view as time of day Select graph 1 and graph 2 buttons Copy data from graph into a text style file.

I am trying to simulate manual interaction with Wireshark IO graph and the capture button.

right now I am using the following:

  • tshark -r myfile -2 -w 10.0.2.15.dst -R "ip.dst == 10.0.2.15"
  • tshark -r myfile -2 -w 10.0.2.15.src -R "ip.src == 10.0.2.15"
  • tshark -q -z io,stat,10 -r 10.0.2.15.dst > 10.0.2.15.dst.txt
  • tshark -q -z io,stat,10 -r 10.0.2.15.src > 10.0.2.15.dst.txt

The problem is I need wall clock time I would like to simulate the data generated by IO Chart in batch mode that would show Recorded Time, IP=dst, IP=src

I need wall clock time so I can compare results on other activities within the lab. If I could have an output of the first and last entry based on wall time I could re-calc the back into something useful.

v/r

Brad M

asked 15 Mar '16, 12:26

Brad%20M's gravatar image

Brad M
6335
accept rate: 0%

sorry about the small error I have in the > of 10.0.2.15.dst.txt twice

(15 Mar '16, 12:34) Brad M

I have updated my tshark command line after finding additional info

tshark -z io,stat,10,ip.src==10.0.2.15,ip.dst==10.0.2.15 -r myfile > 10.0.2.15.results.text

I am still trying to figure a way to use real time versus ticks.

(15 Mar '16, 12:59) Brad M

After searching thru about 5 years of posts I did come across one option that works

tshark -t ad -q -z io,stat,10,ip.dst=10.0.2.15,ip==10.0.2.15 -nr myfile > hostname.io.performance.txt

At least now I don't have to wait over 20 mins while playing with Wireshark to just extract performance data for each IP set that I am looking for.

A bit more work in Excel to re-format the data . . . but nothing compared to the time waiting for a laptop to respond to clicks.

permanent link

answered 15 Mar '16, 13:32

Brad%20M's gravatar image

Brad M
6335
accept rate: 0%

edited 15 Mar '16, 13:35

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×55
×10

question asked: 15 Mar '16, 12:26

question was seen: 1,154 times

last updated: 15 Mar '16, 13:35

p​o​w​e​r​e​d by O​S​Q​A