 | 1 | initial version |
I will answer my own question, it was dumb from me, I just need to negate my previous(es) request each time:
request = "tshark -r " + pcap + " -q -z io,stat,0,\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ af31 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not " + af31 + " and " + af22 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not (" + af31 + " or " + af22 + ") and " + af11 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not (" + af31 + " or " + af22 + " or " + af11 + ") and " + cs1 + ")',\
COUNT'(ip.dsfield.dscp)ip.dsfield.dscp&&( "+ "not (" + af31 + " or " + af22 + " or " + af11 + " or " + cs1 + ") and " + default + ")'" 
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.