This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to get number of packets displayed via tshark?

0
1

I'm using to tshark in my bash script and i want to get the number of packets displayed after filtering.

asked 25 Sep '11, 02:52

ddayan's gravatar image

ddayan
41151720
accept rate: 0%


2 Answers:

2

Does tshark -r file.pcap -R <filter> | wc -l work for you?

answered 25 Sep '11, 07:31

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

I ended up using tshark -r p2/packet_dumps/packet_dump-$file_id -z io,phs,$filter | grep radiotap but your solution works as well

(26 Sep '11, 02:27) ddayan

1

TShark statistics

$ tshark -r test.pcap -qz io,stat,30,"COUNT(frame) frame"
===================================================================
IO Statistics
Interval: 30.000 secs
Column #0: COUNT(frame) frame
                |   Column #0
Time            |          COUNT
000.000-030.000               943
030.000-060.000               677
060.000-090.000                25
===================================================================
You can change the interval:
$ tshark -r test.pcap -qz io,stat,90,"COUNT(frame) frame"
===================================================================
IO Statistics
Interval: 90.000 secs
Column #0: COUNT(frame) frame
                |   Column #0
Time            |          COUNT
000.000-090.000              1645
===================================================================

Hope this helps.

answered 25 Sep '11, 07:30

joke's gravatar image

joke
1.3k4934
accept rate: 9%