This is our old Q&A Site. Please post any new questions and answers at

Hey there,

is there any way I can specify the

tshark -r file.pcap -qz "io,stat,1,AVG(tcp.analysis.ack_rtt)tcp.analysis.ack_rtt"

output, to 1. give me absolute time intervals and 2. give me more than milliseconds as a resolution for the AVG values?

thx as always in advance

asked 05 Jan '12, 09:14

Landi's gravatar image

accept rate: 28%

edited 05 Jan '12, 19:22

Guy%20Harris's gravatar image

Guy Harris ♦♦

(1) is not currently possible. Bug 1850 has been asking for that functionality since 2007. (It just needs someone to implement it.)

For (2) you can upgrade to 1.7.0 (or the SVN trunk) and io,stat will give you microseconds.

permanent link

answered 05 Jan '12, 10:45

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Jan '12, 09:14

question was seen: 3,461 times

last updated: 05 Jan '12, 19:22

p​o​w​e​r​e​d by O​S​Q​A