0

Tshark displays Size values with bytes units

asked 2022-07-06 14:55:38 +0000

insilicium
1 ●1 ●2 ●3

updated 2022-07-06 15:10:24 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23850 ●4 ●988 ●227 https://www.wireshark.org

The command below, with tshark version 3.2.3:

tshark -qtu -z conv,tcp -r file.pcap > output

gives me the output in the form (I omit the header):

10.xx.xxx.xxx:63150  <-> 10.yyy.yy.yy:104 0 0 6502 9474992 6502 9474992 05:47:57  684,
0000
10.xxx.xxx.xxx:49667 <-> 10.yy.yy.ss:104  0 0 5241 7611840 5241 7611840 09:21:49 1117,
0000

In turn, the tshark version 3.4.2 gives me another output:

10.xx.xxx.xxx:63150  <-> 10.yyy.yy.yy:104 0 0 bytes 6502 9.474kB 6502 9.474kB 05:47:57       684,
0000
10.xxx.xxx.xxx:49667 <-> 10.yy.yy.ss:104  0 0 bytes 5241 7.611kB 5241 7.611kB 09:21:49      1117,
0000

That is, the most recent version inserts a kB or bytes units. Is there any option to display the values like the tshark old version, with pure values, without units?

TIA.

edit retag flag offensive close merge delete

Comments

3.4.2 isn't the most recent version, that's currently 3.6.6. That version still outputs the units though.

grahamb ( 2022-07-06 15:10:29 +0000 )edit

2 Answers

Sort by » oldest newest most voted

0

answered 2022-07-06 15:29:47 +0000

Chuckc
3063 ●6 ●623 ●20

Issue 15360: human-readable numbers
Commit e253e627: Use human-readable numbers for conversation stats

tap-iousers.c:

    rx_bytes = format_size(iui->rx_bytes, FORMAT_SIZE_UNIT_BYTES, 0);
    tx_bytes = format_size(iui->tx_bytes, FORMAT_SIZE_UNIT_BYTES, 0);
    total_bytes = format_size(iui->tx_bytes + iui->rx_bytes, FORMAT_SIZE_UNIT_BYTES, 0);

There is support for FORMAT_SIZE_UNIT_NONE in str_util.h and str_util.c. An option to indicate raw output instead of human readable would be needed for tshark.

edit flag offensive delete link

Comments

Thanks for the reply.

insilicium ( 2022-07-07 12:24:04 +0000 )edit

When we export to CSV format, the raw output works in Wireshark. However, it's not practical to use in a shell script.

insilicium ( 2022-07-07 12:31:10 +0000 )edit

0

answered 2022-09-07 02:49:54 +0000

Chuckc
3063 ●6 ●623 ●20

There is now a related open issue in Gitlab:
18321: Precise byte counts no longer available for ‘tshark -z conv’

edit flag offensive delete link

Comments

Fixed/closed with 19329: conversations_taps: Add preference for machine readable output

Chuckc ( 2025-03-24 16:39:32 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Question Tools

Stats

Asked: 2022-07-06 14:55:38 +0000

Seen: 364 times

Last updated: Jul 06 '22

Related questions