Different statistic results of tshark and wireshark for the same pcap file
I want to calculate the number and size of packets in the trace file, and I get the same number of packets in tshark and wireshark, but the bytes are not the same, in tshark it's:
olsr frames:1171 bytes:142792
data frames:571 bytes:73088
icmp frames:196 bytes:18032
===================================================================
However in wireshark the bytes of olsr, data, icmp are respectively 67848 36544 7056.
The pcap file is here: https://www.dropbox.com/s/4tgkdy3w8mf...
I am on mobile and can't look at the pcap file at the moment.
What was the exact
tshark
command you used? Do the counts change if you include/exclude the 2-pass analysis option,-2
? Which versions of Wireshark/tshark are you using? Please provide Wireshark Help -> About Wireshark information andtshark-v
output if the versions are not the same.I got same tshark results with or without "-2" option - version 3.1.1.
I think Wireshark and tshark are using different data: