Max Frame Rate of select Traffic?

asked 2024-01-28 19:27:25 +0000

MTYKAYA
1 ●1

Hi,

This is a easy to do in Wireshark GUI. Problem is that I have too many Capture files and they are all big size. I want to do it with it with Tshark in a batch Script which can run overnight. Using a filter in tshark also straight forward and I was lucky to find following too for Frame Rates:

tshark -r xx.pcap -qz io,stat,1,"COUNT(frame) frame"

How is it possible to bring a criteria(filter) here with above command so that I can list a maximum Frame Rate for specific VLAN ID or? I tried using a pipe like "tshark | tshark" but seems not working.

In theory I can read & filter and create another pcap before I can use above command but I want to avoid this.

Thanks in Advance.

edit retag flag offensive close merge delete

Comments

Like this:

C:\>tshark -r .\test.pcap
    1   0.000000 192.168.200.135 → 8.8.8.8      ICMP   \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$%&'()*+,-./01234567
    2   0.064683      8.8.8.8 → 192.168.200.135 ICMP   \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$%&'()*+,-./01234567
    3   0.999529 192.168.200.135 → 8.8.8.8      ICMP   \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$%&'()*+,-./01234567
    4   1.072596      8.8.8.8 → 192.168.200.135 ICMP   \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$%&'()*+,-./01234567
    5   1.999272 192.168.200.135 → 8.8.8.8      ICMP   \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A ...

(more)

Chuckc ( 2024-01-28 19:39:38 +0000 )edit

add a comment

answered 2024-01-29 01:19:27 +0000

johnthacker
201 ●37 ●5

updated 2024-01-29 01:20:34 +0000

tshark -r xx.pcap -qz io,stat,1,"COUNT(frame) frame"

In this expression, the second "frame" is in fact a filter. (As you might have noticed, the main display filter given with -Y does not affect the -z io,stat results") For details having to do with how filtering works, the field that appears in the function must also appear in the filter, though the filter can have other fields too. Consult the tshark man page.

You can do what you want with an expression like

tshark -r xx.pcap -qz -io,stat,1,"COUNT(frame)frame && vlan.id == y"

(If, for some reason, you have something odd like an encapsulation that might encapsulate multiple Ethernet frames in a single capture file frame, such as MPEG2TS or GSE, contained in DVB-S2 Baseband Frames, there might be a reason to use

tshark -r xx.pcap -qz -io,stat,1,"COUNT(vlan.id)vlan.id == y"

Which would count the number of times the vlan ID field itself appeared, and thus allow a single frame in the capture file to have multiple VLAN IDs with the same number.)

Comments

Yes...this is it. Thank you for the detailed Answer and Explanation!!

Cheers!

MTYKAYA ( 2024-01-29 21:55:06 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Max Frame Rate of select Traffic?

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Max Frame Rate of select Traffic? edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Max Frame Rate of select Traffic?