 | 1 | initial version |
See The “I/O Graphs” Window for an explanation of COUNT.
In the tshark man page it points out that it is existance of the field, not the field value:
COUNT(field)filter - Calculates the number of times that the field name (not its value) appears per interval in the filtered packet list. ''field'' can be any display filter name.
Try tcp.connection.synack as the Y field.
(There should probably be input validation there to only allow field names with COUNT and not a filter expression.)
