Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2019-02-13 20:14:08 +0000

Flo gravatar image

I will answer my own question, it was dumb from me, I just need to negate my previous(es) request each time:

request = "tshark -r " + pcap + " -q -z io,stat,0,\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ af31 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not " + af31 + " and " + af22 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not (" + af31 + " or " + af22 + ") and " +  af11 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not (" + af31 + " or " + af22 + " or " + af11 + ") and " + cs1 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not (" + af31 + " or " + af22 + " or " + af11 + " or " + cs1 + ") and " + default + ")'"