Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Look at -z io,stat,interval[,filter][,filter][,filter]…​ in the tshark man page.
It's not CSV so the output will need to be reformatted.
(similar question asking for CSV output: [How to convert TCP flows in .pcap file to .csv file])(https://ask.wireshark.org/question/26327/how-to-convert-tcp-flows-in-pcap-file-to-csv-file/)

$ tshark -r ./stream-0.pcap -z io,stat,1,"COUNT(frame)frame","COUNT(frame)tcp","COUNT(frame)http" -q

====================================
| IO Statistics                    |
|                                  |
| Duration: 5.300276 secs          |
| Interval: 1 secs                 |
|                                  |
| Col 1: COUNT(frame)frame         |
|     2: COUNT(frame)tcp           |
|     3: COUNT(frame)http          |
|----------------------------------|
|          |1      |2      |3      |
| Interval | COUNT | COUNT | COUNT |
|----------------------------------|
|  0 <> 1  |     8 |     8 |     2 |
|  1 <> 2  |     0 |     0 |     0 |
|  2 <> 3  |     0 |     0 |     0 |
|  3 <> 4  |     0 |     0 |     0 |
|  4 <> 5  |     0 |     0 |     0 |
|  5 <> Dur|     4 |     4 |     0 |
====================================
$

Look at -z io,stat,interval[,filter][,filter][,filter]…​ in the tshark man page.
It's not CSV so the output will need to be reformatted.
(similar question asking for CSV output: [How How to convert TCP flows in .pcap file to .csv file])(https://ask.wireshark.org/question/26327/how-to-convert-tcp-flows-in-pcap-file-to-csv-file/)file)

$ tshark -r ./stream-0.pcap -z io,stat,1,"COUNT(frame)frame","COUNT(frame)tcp","COUNT(frame)http" -q

====================================
| IO Statistics                    |
|                                  |
| Duration: 5.300276 secs          |
| Interval: 1 secs                 |
|                                  |
| Col 1: COUNT(frame)frame         |
|     2: COUNT(frame)tcp           |
|     3: COUNT(frame)http          |
|----------------------------------|
|          |1      |2      |3      |
| Interval | COUNT | COUNT | COUNT |
|----------------------------------|
|  0 <> 1  |     8 |     8 |     2 |
|  1 <> 2  |     0 |     0 |     0 |
|  2 <> 3  |     0 |     0 |     0 |
|  3 <> 4  |     0 |     0 |     0 |
|  4 <> 5  |     0 |     0 |     0 |
|  5 <> Dur|     4 |     4 |     0 |
====================================
$