This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
0
1

I'm using to tshark in my bash script and i want to get the number of packets displayed after filtering.

asked 25 Sep '11, 02:52

ddayan's gravatar image

ddayan
41151720
accept rate: 0%


Does tshark -r file.pcap -R <filter> | wc -l work for you?

permanent link

answered 25 Sep '11, 07:31

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

I ended up using tshark -r p2/packet_dumps/packet_dump-$file_id -z io,phs,$filter | grep radiotap but your solution works as well

(26 Sep '11, 02:27) ddayan

TShark statistics

$ tshark -r test.pcap -qz io,stat,30,"COUNT(frame) frame"
===================================================================
IO Statistics
Interval: 30.000 secs
Column #0: COUNT(frame) frame
                |   Column #0
Time            |          COUNT
000.000-030.000               943
030.000-060.000               677
060.000-090.000                25
===================================================================
You can change the interval:
$ tshark -r test.pcap -qz io,stat,90,"COUNT(frame) frame"
===================================================================
IO Statistics
Interval: 90.000 secs
Column #0: COUNT(frame) frame
                |   Column #0
Time            |          COUNT
000.000-090.000              1645
===================================================================

Hope this helps.

permanent link

answered 25 Sep '11, 07:30

joke's gravatar image

joke
1.3k4934
accept rate: 9%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832

question asked: 25 Sep '11, 02:52

question was seen: 20,578 times

last updated: 26 Sep '11, 02:27

p​o​w​e​r​e​d by O​S​Q​A