|
The display filter used by Sebastian is to limit
the statistics. The problem is the regional setting. Which is probably set to a
region in which the "," is the decimal separator. If you set the decimal
separator to "." (dot), the command will work...
There is already a bug for this on bugzilla
too...
Cheers,
Sake
----- Original Message -----
Sent: Tuesday, December 08, 2009 5:28
PM
Subject: Re: [Wireshark-users] Problems
with tshark displayfilters
Isn't the display filter set using -R option. I don't see that
in your command.
On Tue, Dec 8, 2009 at 8:57 AM, Sebastian Dahlbruch
<Paule_De@xxxxxx> wrote:
Hello
!
So I want to use tshark (v 1.2.4) to get information out of the
captures to a txt file, afterwards I want to convert the txt to a csv and
create statistics out of it.
But when using tshark it seems to ignore all
display filters I'm using.
Here is an example I've found:
"tshark.exe
-q -z "io,stat,600, ,tcp.port == 80" -r DividedFile_1.pcap >>
stats.txt"
This should lead to a txt file
containing:
===================================================================
IO
Statistics
Interval: 600.000 secs
Column #0:
Column #1: tcp.port ==
80
|
Column #0 | Column #1
Time
|frames| bytes |frames| bytes
000.000-600.000 281214
128192886 51408
28494414
===================================================================
(I
hope this is properly formatted now)
But in my case I only get the first
column.
So I tried it with just one filter:
"tshark.exe -q -z
"io,stat,600,tcp.port == 80" -r DividedFile_1.pcap >>
stats.txt"
===================================================================
IO
Statistics
Interval: 600.000 secs
Column #0:
| Column #0
Time
|frames| bytes
000.000-600.000 281214
128192886
===================================================================
Same
result with no filter option set, or like before with both filters
on.
The same happens when using different filters like ip.addr (even if
it's not on the same subnet) or different ports.
Does anyone here have an
answer explaining this behaviour or maybe a complete different solution
?
Because I seem to be the only one having this problem I guess I'm doing
something wrong here.
Thanks in
advance!
Greetings
Sebastian
--
Jetzt
kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3.5
-
sicherer, schneller und einfacher! http://portal.gmx.net/de/go/chbrowser
___________________________________________________________________________
Sent
via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:
http://www.wireshark.org/lists/wireshark-users
Unsubscribe:
https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
___________________________________________________________________________
Sent
via: Wireshark-users mailing list
<wireshark-users@xxxxxxxxxxxxx>
Archives:
http://www.wireshark.org/lists/wireshark-users
Unsubscribe:
https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
|
