This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am currently using this...

tshark -r "C:\Users\admin\Desktop\test\capture.cap" -o ip.use_geoip:TRUE -T fields -e frame.len -e ip.src -e ip.dst -e ip.geoip.dst_asnum

My result...

12469 60 192.168.3.98 208.117.253.29 AS43515 YOUTUBE

What values does the "12469" and "60" represent(I know frame length), but is the "12469" bytes and the "60" the number of packets?

asked 16 May '16, 10:41

zer0day's gravatar image

zer0day
217811
accept rate: 60%

edited 16 May '16, 10:42


My guess is that you're using an old version of Wireshark and it's incorrectly displaying the capture count (12469 in this case). What version of Wireshark are you using? You could try upgrading your version of Wireshark to see if it resolves your problem.

permanent link

answered 16 May '16, 12:14

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

I am using tshark version 1.12.8, less than 6 months old. This is a capture reflecting 40+ users on our network, so if you think it's incorrect cause it is a large number, just letting you know that it could be correct.

(16 May '16, 12:33) zer0day

In that case, I'm not sure why the first number is being printed. I tried this on my system with both 1.12.0 and 1.12.11 and neither one print the first erroneously displayed number. Maybe it's data-dependent? Can you post the capture file somewhere?

(16 May '16, 12:39) cmaynard ♦♦

My bad, the "12469" value is a count of how many frames were seen between the 192.168.x.x source and the destination, it's a line in my script that preforms this operation. So then , what does the "60" represent? 60b, 60kb, 60mb?

(16 May '16, 12:47) zer0day
1

The unit for frame length is bytes.

(16 May '16, 13:10) cmaynard ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×41
×29
×23
×16

question asked: 16 May '16, 10:41

question was seen: 1,473 times

last updated: 16 May '16, 13:10

p​o​w​e​r​e​d by O​S​Q​A