Ask Your Question

tshark display filter count

asked 2019-11-14 18:11:57 +0000

Using the display filter for HTTP URI, I need to determine the number of packets returned as a result of the filter. I believe "tshark -r test.pcap -Y http.request.uri" filters the results to display the packets I need to count. "tshark -r tsharklab.pcap -Y "http.request.full_uri" -Tfields -e http.request.full_uri |sort| uniq -c" appears to provide a count for each URI but not a total count. Trying to do this in tshark, any suggestions?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-11-14 18:43:15 +0000

Chuckc gravatar image
   wc - print newline, word, and byte counts for each file

Send the output of tshark through wc -l

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2019-11-14 18:11:57 +0000

Seen: 493 times

Last updated: Nov 14 '19