 | 1 | initial version |
tcp.time_delta Time since previous frame in this TCP stream
If the capture has more than one stream in parallel then the sum can be larger than the elapsed time.
Changing the filter on the sum will sum data for a single stream.
-qz io,stat,0,SUM(tcp.time_delta)tcp.stream==0