 | 1 | initial version |
Look at -z io,stat,interval[,filter][,filter][,filter]… in the tshark man page.
It's not CSV so the output will need to be reformatted.
(similar question asking for CSV output: [How to convert TCP flows in .pcap file to .csv file])(https://ask.wireshark.org/question/26327/how-to-convert-tcp-flows-in-pcap-file-to-csv-file/)
$ tshark -r ./stream-0.pcap -z io,stat,1,"COUNT(frame)frame","COUNT(frame)tcp","COUNT(frame)http" -q ==================================== | IO Statistics | | | | Duration: 5.300276 secs | | Interval: 1 secs | | | | Col 1: COUNT(frame)frame | | 2: COUNT(frame)tcp | | 3: COUNT(frame)http | |----------------------------------| | |1 |2 |3 | | Interval | COUNT | COUNT | COUNT | |----------------------------------| | 0 <> 1 | 8 | 8 | 2 | | 1 <> 2 | 0 | 0 | 0 | | 2 <> 3 | 0 | 0 | 0 | | 3 <> 4 | 0 | 0 | 0 | | 4 <> 5 | 0 | 0 | 0 | | 5 <> Dur| 4 | 4 | 0 | ==================================== $
| | 2 | No.2 Revision |
Look at -z io,stat,interval[,filter][,filter][,filter]… in the tshark man page.
It's not CSV so the output will need to be reformatted.
(similar question asking for CSV output: [How How to convert TCP flows in .pcap file to .csv file])(https://ask.wireshark.org/question/26327/how-to-convert-tcp-flows-in-pcap-file-to-csv-file/)file)
$ tshark -r ./stream-0.pcap -z io,stat,1,"COUNT(frame)frame","COUNT(frame)tcp","COUNT(frame)http" -q ==================================== | IO Statistics | | | | Duration: 5.300276 secs | | Interval: 1 secs | | | | Col 1: COUNT(frame)frame | | 2: COUNT(frame)tcp | | 3: COUNT(frame)http | |----------------------------------| | |1 |2 |3 | | Interval | COUNT | COUNT | COUNT | |----------------------------------| | 0 <> 1 | 8 | 8 | 2 | | 1 <> 2 | 0 | 0 | 0 | | 2 <> 3 | 0 | 0 | 0 | | 3 <> 4 | 0 | 0 | 0 | | 4 <> 5 | 0 | 0 | 0 | | 5 <> Dur| 4 | 4 | 0 | ==================================== $
