Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Differences between Tshark bitrate output command and Wireshark graph?

Hello. I am running a setup where I SSH into a server that has access to several devices. This machine is running the 64-bit Tshark version 3.2.14.
Out of those devices, I am running TShark on two PIs that are communicating, capturing to a file, and then transferring that PCAPNG file over to the server. These PIs are using 32-bit Tshark version 3.2.14.

On the server, after transferring, I am calling:
tshark -r {FILE} -2 -R "ip.src=={IP} or ip.dst=={IP}" -t ud -q -z io,stat,1
This spits out information regarding the bitrate which looks like the following:
...
| 2022-01-20 15:06:41 | 378 | 151872 |
| 2022-01-20 15:06:42 | 383 | 155352 |
| 2022-01-20 15:06:43 | 414 | 155804 |
| 2022-01-20 15:06:44 | 419 | 157656 |
| 2022-01-20 15:06:45 | 414 | 156554 |
| 2022-01-20 15:06:46 | 412 | 155644 |
| 2022-01-20 15:06:47 | 442 | 159942 |
...
For most runs, this is perfectly fine. I can transfer the files over to my local Windows machine (running a 64-bit 3.2.14 version of TShark/Wireshark) and the IO graph matches the text output.

However, some runs are showing the following output:
...
| 2022-01-20 15:07:20 | 342 | 132810 |
| 2022-01-20 15:07:21 | 0 | 0 |

Or
...
| 2022-01-20 11:58:55 | 248 | 97222 |
| 2022-01-20 11:58:56 | 23 | 8474 |
| 2022-01-20 11:58:57 | 22 | 8410 |
| 2022-01-20 11:58:58 | 22 | 8810 |
...
where the first line is unreasonably large in "frames" and "bytes" columns. When I pull it over to my machine and open the graph, I am not seeing this. Everything looks normal. For a 9kB test, I get the usual ~8.4kB results. If I go to the main Wireshark window and apply the same src/dst filter, I can see all of the packets, manually add their size for the first 1-second interval, and I can confirm that the packet info matches the graph.

For the particular run that shows the "342 frames, 132810 bytes" in the first-second interval, I am actually not seeing any traffic on the IO graph, but I do see all of the packets in the main Wireshark page. For this scrambled page, it appears to be 172.18.89.41 as the ip.src||ip.dst filter.

Any idea what causes this difference between the textual command and the Wireshark view? Does it relate at all to me not seeing any of the filtered packets on the IO graph? Or perhaps why I still keep seeing the window go out to 250,000 seconds?
When I attempt to upload a file, I am told that I do not have enough points, so please let me know what other info you may need to help track down the issue!

Differences between Tshark bitrate output command and Wireshark graph?

Hello. I am running a setup where I SSH into a server that has access to several devices. This machine is running the 64-bit Tshark version 3.2.14.
Out of those devices, I am running TShark on two PIs that are communicating, capturing to a file, and then transferring that PCAPNG file over to the server. These PIs are using 32-bit Tshark version 3.2.14.

On the server, after transferring, I am calling:
tshark -r {FILE} -2 -R "ip.src=={IP} or ip.dst=={IP}" -t ud -q -z io,stat,1
This spits out information regarding the bitrate which looks like the following:
...
| 2022-01-20 15:06:41 | 378 | 151872 |
| 2022-01-20 15:06:42 | 383 | 155352 |
| 2022-01-20 15:06:43 | 414 | 155804 |
| 2022-01-20 15:06:44 | 419 | 157656 |
| 2022-01-20 15:06:45 | 414 | 156554 |
| 2022-01-20 15:06:46 | 412 | 155644 |
| 2022-01-20 15:06:47 | 442 | 159942 |
...
For most runs, this is perfectly fine. I can transfer the files over to my local Windows machine (running a 64-bit 3.2.14 version of TShark/Wireshark) and the IO graph matches the text output.

However, some runs are showing the following output:
...
| 2022-01-20 15:07:20 | 342 | 132810 |
| 2022-01-20 15:07:21 | 0 | 0 |

Or
...
| 2022-01-20 11:58:55 | 248 | 97222 |
| 2022-01-20 11:58:56 | 23 | 8474 |
| 2022-01-20 11:58:57 | 22 | 8410 |
| 2022-01-20 11:58:58 | 22 | 8810 |
...
where the first line is unreasonably large in "frames" and "bytes" columns. When I pull it over to my machine and open the graph, I am not seeing this. Everything looks normal. For a 9kB test, I get the usual ~8.4kB results. If I go to the main Wireshark window and apply the same src/dst filter, I can see all of the packets, manually add their size for the first 1-second interval, and I can confirm that the packet info matches the graph.

For the particular run that shows the "342 frames, 132810 bytes" in the first-second interval, I am actually not seeing any traffic on the IO graph, but I do see all of the packets in the main Wireshark page. For this scrambled page, it appears to be 172.18.89.41 as the ip.src||ip.dst filter.

Any idea what causes this difference between the textual command and the Wireshark view? Does it relate at all to me not seeing any of the filtered packets on the IO graph? Or perhaps why I still keep seeing the window go out to 250,000 seconds?
When I attempt to upload a file, I am told that I do not have enough points, so please let me know what other info you may need to help track down the issue!issue!
EDIT: Here is the file link,
https://drive.google.com/file/d/1TbfkEIA2pZFvK4dIu3WxVNIHhrOe0qlr/view?usp=sharing

Differences between Tshark bitrate output command and Wireshark graph?

Hello. I am running a setup where I SSH into a server that has access to several devices. This machine is running the 64-bit Tshark version 3.2.14.
Out of those devices, I am running TShark on two PIs that are communicating, capturing to a file, and then transferring that PCAPNG file over to the server. These PIs are using 32-bit Tshark version 3.2.14.

On the server, after transferring, I am calling:
calling:

tshark -r {FILE} -2 -R "ip.src=={IP} or ip.dst=={IP}" -t ud -q -z io,stat,1 
io,stat,1

This spits out information regarding the bitrate which looks like the following:
...

| 2022-01-20 15:06:41 |    378 | 151872 | 
| 2022-01-20 15:06:42 | 383 | 155352 |
| 2022-01-20 15:06:43 | 414 | 155804 |
| 2022-01-20 15:06:44 | 419 | 157656 |
| 2022-01-20 15:06:45 | 414 | 156554 |
| 2022-01-20 15:06:46 | 412 | 155644 |
| 2022-01-20 15:06:47 | 442 | 159942 |
...
|

For most runs, this is perfectly fine. I can transfer the files over to my local Windows machine (running a 64-bit 3.2.14 version of TShark/Wireshark) and the IO graph matches the text output.

However, some runs are showing the following output:
...

| 2022-01-20 15:07:20 |    342 | 132810 | 
| 2022-01-20 15:07:21 | 0 | 0 |

|

Or
...

| 2022-01-20 11:58:55 |    248 | 97222 | 
| 2022-01-20 11:58:56 | 23 | 8474 |
| 2022-01-20 11:58:57 | 22 | 8410 |
| 2022-01-20 11:58:58 | 22 | 8810 |
...
|

where the first line is unreasonably large in "frames" and "bytes" columns. When I pull it over to my machine and open the graph, I am not seeing this. Everything looks normal. For a 9kB test, I get the usual ~8.4kB results. If I go to the main Wireshark window and apply the same src/dst filter, I can see all of the packets, manually add their size for the first 1-second interval, and I can confirm that the packet info matches the graph.

For the particular run that shows the "342 frames, 132810 bytes" in the first-second interval, I am actually not seeing any traffic on the IO graph, but I do see all of the packets in the main Wireshark page. For this scrambled page, it appears to be 172.18.89.41 as the ip.src||ip.dst filter.

Any idea what causes this difference between the textual command and the Wireshark view? Does it relate at all to me not seeing any of the filtered packets on the IO graph? Or perhaps why I still keep seeing the window go out to 250,000 seconds?
When I attempt to upload a file, I am told that I do not have enough points, so please let me know what other info you may need to help track down the issue!
EDIT: Here is the file link,
https://drive.google.com/file/d/1TbfkEIA2pZFvK4dIu3WxVNIHhrOe0qlr/view?usp=sharing