Tshark displays Size values with bytes units - Ask Wireshark

First time here? Check out the FAQ!

0

Tshark displays Size values with bytes units

asked Jul 6 '2

insilicium
1 ●1 ●2 ●3

updated Jul 6 '2

flag of United Kingdom of Great Britain and Northern Ireland

23850 ●4 ●988 ●227 https://www.wireshark.org

The command below, with tshark version 3.2.3:

tshark -qtu -z conv,tcp -r file.pcap > output

gives me the output in the form (I omit the header):

10.xx.xxx.xxx:63150  <-> 10.yyy.yy.yy:104 0 0 6502 9474992 6502 9474992 05:47:57  684,
0000
10.xxx.xxx.xxx:49667 <-> 10.yy.yy.ss:104  0 0 5241 7611840 5241 7611840 09:21:49 1117,
0000

In turn, the tshark version 3.4.2 gives me another output:

10.xx.xxx.xxx:63150  <-> 10.yyy.yy.yy:104 0 0 bytes 6502 9.474kB 6502 9.474kB 05:47:57       684,
0000
10.xxx.xxx.xxx:49667 <-> 10.yy.yy.ss:104  0 0 bytes 5241 7.611kB 5241 7.611kB 09:21:49      1117,
0000

That is, the most recent version inserts a kB or bytes units. Is there any option to display the values like the tshark old version, with pure values, without units?

TIA.

Comments

3.4.2 isn't the most recent version, that's currently 3.6.6. That version still outputs the units though.

grahamb ( Jul 6 '2 )

2 Answers

Sort by » oldest newest most voted

0

answered Jul 6 '2

Chuckc
3048 ●6 ●620 ●20

Issue 15360: human-readable numbers
Commit e253e627: Use human-readable numbers for conversation stats

tap-iousers.c:

    rx_bytes = format_size(iui->rx_bytes, FORMAT_SIZE_UNIT_BYTES, 0);
    tx_bytes = format_size(iui->tx_bytes, FORMAT_SIZE_UNIT_BYTES, 0);
    total_bytes = format_size(iui->tx_bytes + iui->rx_bytes, FORMAT_SIZE_UNIT_BYTES, 0);

There is support for FORMAT_SIZE_UNIT_NONE in str_util.h and str_util.c. An option to indicate raw output instead of human readable would be needed for tshark.

Comments

Thanks for the reply.

insilicium ( Jul 7 '2 )

When we export to CSV format, the raw output works in Wireshark. However, it's not practical to use in a shell script.

insilicium ( Jul 7 '2 )

0

answered Sep 7 '2

Chuckc
3048 ●6 ●620 ●20

There is now a related open issue in Gitlab:
18321: Precise byte counts no longer available for ‘tshark -z conv’

Comments

Fixed/closed with 19329: conversations_taps: Add preference for machine readable output

Chuckc ( Mar 24 '5 )

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Question Tools

Stats

Asked: Jul 6 '2

Seen: 362 times

Last updated: Jul 06 '22

Related questions