I'm looking for TSHARK syntax to count:
This needs to be OS-independent, so pipes and OS-specific commands can't be used...
Thanks a lot for any help
asked 22 Mar '12, 12:31
edited 22 Mar '12, 16:26
Simply use I/O stasistics for that:
c:\tshark -r tracefile.pcap -qz io,stat,0,ip.src==188.8.131.52,ip.dst==184.108.40.206,tcp.dstport==80
answered 26 Mar '12, 03:35
edited 26 Mar '12, 03:37
How OS independent does it need to be? If you need *nix AND Windows then you'll be struggling as it will need some scripting and the native script environments are wildly different.
The tshark manual page lists all the options for tshark, you'll probably want to look at the '-T fields' with some '-e' options, e.g. '-T fields -e ip.src' to get a list of the source ip's, '-T fields -e ip.dst' for destination IP's and '-T fields -e tcp.dstport' for the destination port.
answered 22 Mar '12, 13:32