Ask Your Question
0

Using tshark to display throughput on a live capture

asked 2019-06-26 19:02:11 +0000

tkzheng gravatar image

updated 2019-06-26 20:19:01 +0000

I'm attempting to use tshark to get statistics on a live TCP connection. My aim is to get the RTT, lost packets, and throughput. My current command is below:

tshark -P -i eno1 -f 'tcp and port 5201' -T fields -E separator=, -e tcp.analysis.ack_rtt -e tcp.analysis.lost_segment | tee log.txt

What can I add in order to get throughput of the connection? I looked around and saw in wireshark there were IO statistics and TCP stream graph, but is there a way to get that data on the command line?

If there is no way to do so, which values would I need to attain (maybe relative time or bytes acked and stuff) in order for me to manually calculate the throughput by piping the output through a python program?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-06-26 20:29:49 +0000

grahamb gravatar image

IMHO Wireshark is the wrong tool for this, it's a Packet Analyser that can incidentally produce statistics about the traffic.

You should look at other tools, e.g. ntop (or ntopng as it now seems to be called).

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-06-26 19:02:11 +0000

Seen: 1,212 times

Last updated: Jun 26 '19