This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Absolute time in statistics from “tshark -z io,stat”

0

Hi,

To get some traffic statistics on multiple capture files in a folder, I am using a batch file running a simple tshark command e.g. "tshark -z io,stat,1,ip.addr==1.2.3.4" on each file one after the other, resulting in a large csv file containing the results.

Unluckily, the statistics generated by this command use Relative Time i.e. timestamps start at zero for each new file.

I was wondering why the output time format using tshark –z io,stat cannot be changed from relative to absolute, eg. using “–t ad”. I found on the mailing list a patch for tap-iostat.c which seem to allow such behaviour. http://www.wireshark.org/lists/wireshark-dev/200608/msg00213.html

So maybe this question is for devs/advisors, could it be integrated into an upcoming release? Thanks!

asked 16 Apr '12, 09:50

yul_analyzer's gravatar image

yul_analyzer
6558
accept rate: 0%


One Answer:

1

I opened bug 7207 to ensure that patch doesn't get lost again. You might want to subscribe yourself to that bug to track its progress.

answered 27 Apr '12, 07:27

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Patch has been applied on trunk and 1.8.0 is now including the corresponding revision, thx!

(05 Jul '12, 12:53) yul_analyzer