How can i tshark a folder full of tracefiles for the biggest tcp stream in each trace?

Question

I'm tracing issues with Window Scaling from client to server, after a batch testfile (with copy commands for file transfers) i want to analyse all tracefiles for throughput, window sizes, application read requests and so on, but..... from every trace i only need the biggest tcp stream. Most of the time it's "tcp.stream eq 0" but sometimes not.. How to tshark a folder full of traces for the biggest tcp stream in each trace?

As always, all answers are highly appreciated!

Accepted Answer

So the "koel" stuff you're looking for might be looking something like this?

for file in *.pcap
do 
  tshark -r $file -w largest-stream-from-$file \
     -R `tshark -nlr $file -R "tcp.flags.fin==1 or tcp.flags.reset==1" -T fields -e tcp.seq -e tcp.ack -e tcp.stream | \
           awk 'BEGIN {max=1} {sum=$1+$2;if(sum>max) {max=sum;stream=$3}} END {printf("tcp.stream==%d",stream)}'`
done

(only works with relative sequence numbering on and for streams in which the sequence number does not wrap)

Answer 2

You can use tshark statistics to create a table of all tcp conversations:
$ tshark -r test.pcap -q -z conv,tcp
================================================================================
TCP Conversations
Filter:<no filter="">
                                               |       <-      | |       ->      | |     Total     |
                                               | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |
192.168.108.2:2720     <-> 147.234.1.253:21          28      2306      18      1047      46      3353
147.234.1.253:58999    <-> 192.168.108.2:2721         3       170       2       122       5       292
192.168.108.2:2718     <-> 147.137.21.94:139          0         0       3       186       3       186
192.168.108.2:2717     <-> 147.137.21.94:445          0         0       3       186       3       186
================================================================================
Or use this little script:
for file in ls -1 *.pcap
do
tshark -r $file -q -z conv,tcp > $file.txt
done