This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I know that with the -z io,stat,0.01 you can specify seconds as intervals, but what I want to do is list conv,ip every 1 ~ 10 milliseconds.

tshark -q -r Test.pcapng -z conv,ip will give me all conversations but that's for a 34MByte file. I would hate to have to use editcap to break this 34MB file up into oodles of 1 ~ 10msec files and then run this command on all the oodles of files, but I find no way to specify start and stop time using tshark!

Any recommendations?

How about modifying/adding a new variable to the conv,ip command to like below: tshark -q -r Test.pcapng -z conv,ip,0.010 (dump conv,ip every 10 msecs) tshark -q -r Test.pcapng -z conv,ip,0.001 (dump conv,ip every msec)

Cheers,

asked 13 Mar '17, 23:24

wbenton's gravatar image

wbenton
29227
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×23
×5
×2
×2

question asked: 13 Mar '17, 23:24

question was seen: 578 times

last updated: 13 Mar '17, 23:24

p​o​w​e​r​e​d by O​S​Q​A