Piping tshark to sed intermittently displays packet number in addition to filter.

edit

This is a bug in Wireshark. Please file a bug report on this at the Wireshark Bugzilla.

The number being printed is a count of packets captured. TShark won't print that if it's printing the packet information directly to a terminal, but it will do so if it hasn't been run with -q and it's not writing to a terminal.

Unfortunately, if it's writing to a pipe, it doesn't know whether the program at the end of the pipeline is writing to the terminal, so it can't suppress the packet count only in that case.

Equally unfortunately, there's no way to say "print packet information to the standard output but don't print the packet count"; -q will suppress the packet count and the packet information. The bug here is that you have no way to get packet information without packet counts if you're writing to a pipe. (And, in fact, -T fields should be sufficient to indicate that packet information should be sent to the standard output.)

Dropping -l means that packet information is buffered within the print routines in the C library, meaning that it won't be sent to the standard output until 4096 or so bytes of packet information have been written; it's not suppressed, it's just delayed, possibly for a long time. The packet counts are directly written to the standard error by TShark, so they show up.