This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark: multiple packets on the same line

0

I noticed that when I filter high speed traffic with tshark from a tcpdump capture file, it will print multiple packets on the same line. For a lot of fields instead of a single value there are multiple values separated by commas.

10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10     10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16,10.0.0.16 101.7.150.218,101.7.150.244,101.7.151.14,101.7.151.40,101.7.151.66,101.7.151.92,101.7.151.118,101.7.151.144,101.7.151.170,101.7.151.196,101.7.151.222,101.7.151.248,101.7.152.18,101.7.152.44,101.7.152.70,101.7.152.96,101.7.152.122,101.7.152.148,101.7.152.174,101.7.152.200,101.7.152.226,101.7.152.252,101.7.153.22,101.7.153.48           192.168.107.10  192.168.107.12  1419291086.335348000

where every field is separated by one tab.

This data representation is not a big deal since every field is an array and the information about one specific packet can be found by looking at the same index.

Please could you explain why does this happen? Does this mean that the computer is not fast enough and the packets are queued in network interface?

Thank you.

Edit:

OS: ubuntu 14.04

Commnad: sudo tshark -r tmp_capture.pcapng -R "of10.packet_in.type or of10.flow_add.type" -Tfields -e of10.packet_in.type -e of10.flow_add.type -e arp.src.proto_ipv4 -e arp.dst.proto_ipv4 -e of10.match_v1.ipv4_src -e of10.match_v1.ipv4_dst -e ip.src -e ip.dst -e frame.time_epoch

TShark 1.10.6 (v1.10.6 from master-1.10)

asked 23 Dec '14, 02:36

skywalker's gravatar image

skywalker
11113
accept rate: 0%

edited 23 Dec '14, 04:04

what is your

  • OS and OS version
  • tshark version
  • tshark commandline
(23 Dec '14, 03:22) Kurt Knochner ♦

I have just updated the question.

(23 Dec '14, 04:08) skywalker