stumbling over use of io,stat,0,SUM...

asked 2020-01-07 19:10:30 +0000

Stuart Kendrick
1 ●1 ●4 ●8

updated 2020-01-07 22:38:14 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

I would like to use tshark to SUM tcp.delta_time in a pcap. But clearly I'm fumbling something. Pointers?

tshark 2.6.10

guru> tshark -r sample.pcapng –Y tcp.dstport==443 -o tcp.calculate_timestamps:TRUE -z io,stat,0,"SUM(tcp.time_delta)tcp.time_delta"
guru> tshark: "" was unexpected in this context

Seems to me that the use of "" is required in this context ... what is this error telling me?

tshark 3.20.0

C:\Temp>tshark -r sample.pcapng -o tcp.calculate_timestamps:TRUE -Y tcp.dstport==443 -z io,stat,0."SUM(tcp.time_delta)tcp.time_delta"

tshark: invalid "-z io,stat,<interval>[,<filter>][,<filter>]..." argument

C:\Temp>

Seems like tshark is interpreting this line as belonging to the standard class of '-z io,stat' lines ... whereas I would prefer that it interpret my options as belonging to the "COUNT|SUM|MIN|MAX|AVG|LOAD" approach (https://www.wireshark.org/docs/man-pa...) ... but again, i don't see why tshark is interpreting my options this way

Googling, I can find syntax which looks similar to me https://seclists.org/wireshark/2011/N... https://www.wireshark.org/lists/wires...

But apparently, I'm not copying as accurately as I would like from these past posts.

Suggestions?

--sk

Stuart Kendrick

Comments

Output of tshark -v or confirm this is on Windows. (C:\Temp> in question)
Oops - missed the examples were from Windows and some other OS.

Chuckc ( 2020-01-07 19:46:20 +0000 )edit

add a comment

answered 2020-01-07 19:52:54 +0000

Chuckc
2858 ●5 ●567 ●19

Windows syntax:

C:\>tshark -r .\smtp.pcap -o tcp.calculate_timestamps:TRUE -Y tcp.dstport==443 -z io,stat,0,SUM(tcp.time_delta)tcp.time_delta

============================================
| IO Statistics                            |
|                                          |
| Duration: 9.198 secs                     |
| Interval: 9.198 secs                     |
|                                          |
| Col 1: SUM(tcp.time_delta)tcp.time_delta |
|------------------------------------------|
|                |1         |              |
| Interval       |    SUM   |              |
|---------------------------|              |
| 0.000 <> 9.198 | 7.577713 |              |
============================================

Linux:

root@kali:~# tshark -r ./nfl_short.pcapng  -Y tcp.dstport==443 -o tcp.calculate_timestamps:TRUE -z io,stat,0,SUM\(tcp.time_delta\)tcp.time_delta
Running as user "root" and group "root". This could be dangerous.

============================================
| IO Statistics                            |
|                                          |
| Duration: 3.144 secs                     |
| Interval: 3.144 secs                     |
|                                          |
| Col 1: SUM(tcp.time_delta)tcp.time_delta |
|------------------------------------------|
|                |1         |              |
| Interval       |    SUM   |              |
|---------------------------|              |
| 0.000 <> 3.144 | 3.168073 |              |
============================================
root@kali:~#

edit flag offensive delete link

Comments

Instead of escaping "troublesome" characters in the command line you can also quote them, e.g.

tshark -r ./nfl_short.pcapng  -o tcp.calculate_timestamps:TRUE -Y tcp.dstport==443 -z "io,stat,0,SUM(tcp.time_delta)tcp.time_delta"

Might be more helpful to show the parameters in the same order so that folks don't think it's significant for the OS.

grahamb ( 2020-01-07 22:41:28 +0000 )edit

I happen to be a big fan of the "\" backslash. Especially when trying to remember if it takes 3, 4 or 5 to escape a regular expression in sed or grep. :-)

The issue in the original question was typos:
- there are extra characters between sample.pcapng and the -Y (copy/paste to vi to see these)
- 0."SUM vs 0,"Sum in the second

Chuckc ( 2020-01-08 13:43:10 +0000 )edit

I guess the other thing with escapes is that they tend to be OS\shell specific, whereas quotes don't, although what needs to be quoted is another big ball of hair.

grahamb ( 2020-01-08 13:50:49 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

stumbling over use of io,stat,0,SUM...

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

stumbling over use of io,stat,0,SUM... edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

stumbling over use of io,stat,0,SUM...