You could try running Wireshark's "dumpcap" utility, using the -S command-line option, although that will report traffic on all interfaces it finds. (That's the option that's used in Wireshark to display the "sparkline" graphs on the welcome screen.)
You could use wireshark but it’s the wrong tool for the job. Why not ask the OS? SNMP and such tools are designed for this.
Thanks for your helpful response Bob. Just to be clear - Hi Bob,
Thanks for your helpful information.
The real question is - is there a non-invasive way to simply count the number of packets into and out of a 10 GE or 1x GE port that is either on a router or switch port?
The idea is that we would use a passive splitter/tap to mirror the traffic and direct it to wireshark or a third party device packet analysis device situated between two routers, or between a router and a switch, or between two switches and simply count the total number of ingress/egress packets between these two end points/ports?
If we use any capability that taxes the CPU on a switch or router, it will choke the device due to the high throughputs involved.
So even using SPAN/Port mirroring just to redirect the traffic to wireshark ...
First thought would be to leverage the capabilities of the (unspecified) router or (unspecified) switch. I've yet to find a managed 10G network element that does not have native statistics (i.e. counters build into the hardware, retrievable by SNMP, or device specific means) on port level.
If this is out of the question, then you'll end up with 10G capable hardware taps which spit out two 10G streams, one for uplink, one for downlink. Maybe the tap can already count them for you, otherwise go with dumpcap to capture that trafific, or use the capture machines port counters.
Asked: 2020-08-22 22:30:33 +0000
Seen: 449 times
Last updated: Aug 23 '20
