Can SMB QUEUE DEPTH analysis also could be done by tshark?

Hi All

I am looking into SMB QUEUE DEPTH analysis with tshark. i know hot get smb.time statistics "tshark -nlr c:smb.pcap -qz io,stat,10,"COUNT(smb.time)smb.time","MIN(smb.time)smb.time","AVG(smb.time)smb.time","MAX(smb.time)smb.time" but i can't find the right query for LOAD Please advice Thanks

asked 04 Jun '11, 12:03

tbaror
6●5●5●7
accept rate: 0%

anyone? LOAD(smb.time)smb.time

(05 Jun '11, 02:35) tbaror

See thread at Wireshark User's list.

(06 Jun '11, 00:45) joke

One Answer:

oldest newest most voted

QUEUE DEPTH analysis can now be done by tshark.
Thanks to Ronnie Sahlberg. He has checked in an enhancement to add LOAD() stats to tshark.

Download Wireshark version 1.6.0 and run this command:

$ tshark -r test.pcap -qz "io,stat,360,LOAD(smb.time)smb.time"
===================================================================
IO Statistics
Interval: 360.000 secs
Column #0: LOAD(smb.time)smb.time
                |   Column #0
Time            |           LOAD
000.000-360.000       462.096794
360.000-720.000       100.718411
720.000-1080.000        96.485666
1080.000-1440.000        35.952216
1440.000-1800.000        80.976688
1800.000-2160.000         8.415044

link

answered 08 Jun '11, 21:46

joke
1.2k●3●7●29
accept rate: 10%

thanks :-)

(09 Jun '11, 01:41) tbaror

Your answer

toggle preview

community wiki

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

analysis ×50
smb ×21
depth ×1
queue ×1

Asked: 04 Jun '11, 12:03

Seen: 1,195 times

Last updated: 01 Feb '12, 23:27

Can SMB QUEUE DEPTH analysis also could be done by tshark?

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions