Ask Your Question
0

Problem tshark io,stat interval

asked 2019-02-14 09:03:34 +0000

jcabrejas006 gravatar image

Hi, I'm trying to get 1ms statistics for all packets with vlan priority = 2 in my capture. I use the command

tshark -n -q -r test.pcap -z "io,stat,0.001,vlan.priority==2"

But I get the following error:

tshark: invalid "-z io,stat,<interval>[,<filter>][,<filter>]...0" argument

The command with 1 second interval works fine. (tshark -n -q -r test.pcap -z "io,stat,1,vlan.priority==2")

edit retag flag offensive close merge delete

Comments

What version of tshark are you running? Please provide tshark -v output. (This works fine for me using 2.6.6 on Windows 10.)

cmaynard gravatar imagecmaynard ( 2019-02-14 16:04:24 +0000 )edit

This is the output for tshark -v. I work on a Linux system, Ubuntu 18.04

TShark (Wireshark) 2.6.6 (Git v2.6.6 packaged as 2.6.6-1~ubuntu18.04.0)

Copyright 1998-2019 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with GLib 2.56.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua
5.2.4, with GnuTLS 3.5.18, with Gcrypt 1.8.1, with MIT Kerberos, with MaxMind DB
resolver, with nghttp2 1.30.0, with LZ4, with Snappy, with libxml2 2.9.4 ...
(more)
jcabrejas006 gravatar imagejcabrejas006 ( 2019-02-15 08:49:50 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-02-15 15:07:49 +0000

cmaynard gravatar image

This looks like a locale problem to me. For example, LC_NUMERIC=es_ES.UTF-8 may mean the decimal point in 0.001 is being interpreted as a comma. Here's my locale:

LANG=
LC_CTYPE="C.UTF-8"
LC_NUMERIC="C.UTF-8"
LC_TIME="C.UTF-8"
LC_COLLATE="C.UTF-8"
LC_MONETARY="C.UTF-8"
LC_MESSAGES="C.UTF-8"
LC_ALL=

Maybe you could try changing your locale to see if that helps?

edit flag offensive delete link more

Comments

That was it!! Thank you so much for your help!

jcabrejas006 gravatar imagejcabrejas006 ( 2019-02-19 09:24:30 +0000 )edit

I'm glad this worked for you, but I think it would be worth opening a bug report. You shouldn't have to be forced to change your locale for this to work. That is, if your locale uses a comma for a decimal separator, then 0,001 should work. In this case, I think it makes sense that it fails with 0.001.

cmaynard gravatar imagecmaynard ( 2019-02-19 13:29:44 +0000 )edit

Ok, I'll do it. Where do I go to open the bug report?

jcabrejas006 gravatar imagejcabrejas006 ( 2019-02-20 08:54:34 +0000 )edit

There was a bug report already open, and it looks like they fixed it.

https://bugs.wireshark.org/bugzilla/s...

jcabrejas006 gravatar imagejcabrejas006 ( 2019-02-22 09:06:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-02-14 09:03:34 +0000

Seen: 821 times

Last updated: Feb 14 '19