how to get number of packets displayed via tshark?

Question

I'm using to tshark in my bash script and i want to get the number of packets displayed after filtering.

Accepted Answer

2	Does `tshark -r file.pcap -R <filter> \| wc -l` work for you? answered 25 Sep '11, 07:31 cmaynard ♦♦ 9.4k●10●38●142 accept rate: 20% I ended up using `tshark -r p2/packet_dumps/packet_dump-$file_id -z io,phs,$filter \| grep radiotap` but your solution works as well (26 Sep '11, 02:27) ddayan

Answer 2

TShark statistics

$ tshark -r test.pcap -qz io,stat,30,"COUNT(frame) frame"
===================================================================
IO Statistics
Interval: 30.000 secs
Column #0: COUNT(frame) frame
                |   Column #0
Time            |          COUNT
000.000-030.000               943
030.000-060.000               677
060.000-090.000                25
===================================================================

You can change the interval:

$ tshark -r test.pcap -qz io,stat,90,"COUNT(frame) frame"
===================================================================
IO Statistics
Interval: 90.000 secs
Column #0: COUNT(frame) frame
                |   Column #0
Time            |          COUNT
000.000-090.000              1645
===================================================================

Hope this helps.