Revision history [back]

Have a look at the tshark man page regarding the -z io,stat option.

In the following example, I just used an arbitrary filter of "ip", but where I've used "ip", you'd use "frame matches \"mystring\"":

tshark -q -r file.pcapng -z io,stat,0,"ip"
===================================
| IO Statistics                   |
|                                 |
| Duration: 19.3 secs             |
| Interval: 19.3 secs             |
|                                 |
| Col 1: ip                       |
|---------------------------------|
|              |1               | |
| Interval     | Frames | Bytes | |
|-------------------------------| |
|  0.0 <> 19.3 |      2 |  1072 | |
===================================

The -z io,stat option also supports other features than just simply display filters, such as COUNT(field)filter, which might be all you're looking for here, in which case you could run something like:

tshark -q -r file.pcapng -z io,stat,0,"COUNT(frame)frame matches \"mystring\""

Have a look at the tshark man page regarding the -z io,stat option.

In the following example, I just used an arbitrary filter of "ip", but where I've used "ip", you'd use "frame matches \"mystring\"":

tshark -q -r file.pcapng -z io,stat,0,"ip"
===================================
| IO Statistics                   |
|                                 |
| Duration: 19.3 secs             |
| Interval: 19.3 secs             |
|                                 |
| Col 1: ip                       |
|---------------------------------|
|              |1               | |
| Interval     | Frames | Bytes | |
|-------------------------------| |
|  0.0 <> 19.3 |      2 |  1072 | |
===================================

The -z io,stat option also supports other features than just simply display filters, such as COUNT(field)filter, which might be all you're looking for here, in which case you could run something like:

tshark -q -r file.pcapng -z io,stat,0,"COUNT(frame)frame matches \"mystring\""