Hello everyone,
I am interested in producing plots (packets and bytes) as I/O statistics at 10 ms, 100 ms and a second and the data obtained by the copy button in wireshark. I am using a trace covering 14:00 hrs to 16:00 hrs. My source file is of the size of 11GB in .sk1.tcpdump.priv format. My computer runs out of memory in each attempt. I split the file into six different files using:
$ editcap -c 20000000 source.sk1.tcpdump.priv out-20020413.cap
I can produce the graphics for each file using wireshark. However, each of these plots starts with an "x" number of zeros and joining them seems incorrect (at each join, the bytes or packets or bytes by a unit of time drop to zero).
I also tried $ tshark -q -nr source.sk1.tcpdump.priv -t ad -z io,stat,1,"AVG(frame.len)frame.len" Again, my computer runs out of memory.
How can I get the data to generate these plots for the full period, 14:00 hrs to 16:00 hrs? Alternatively, is any way to join these plots properly.
Any help will be appreciated.
P
