Ask Your Question

Revision history [back]

tshark conversation conv command

Does anyone have tshark version 3.0.0. I am reading an old capture file: tshark -r file.pcap -q -z conv,udp. Just trying to get the bytes sent vs bytes returned for udp. The conv command seems to work with older version of tshark. However, with version 3.0.0 I'm getting unidirectional bytes only. Meaning that if 80 bytes are sent, 0 bytes are returned and vice versa, if 80 bytes are returned, 0 bytes were sent. If you have version 3.0.0 please test it and let me know what you get, what I'm I not doing correctly. Thanks in advance.