HighMem

After several hours I finally found out how to use those tshark statistics filters with the -z option. I couldn't find any clues in the documentation or on the net though, just found the solution by accident...

Even the example from the man page:

  -z 'io,stat,1,ip.addr==1.1.1.1'

may not work!

What can happen is that the comma after the time value "1" is interpreted as the decimal delimiter, for a german locales setting for example, so the rest of the filter string is omitted.

Another example would be writing

  -z io,stat,0.001,ip.addr==1.2.3.4

where tshark will complain that the time value must be >= 0.001, but in this case it really is = 0.001 (one might think).

Either do

export LANG=C

before or write something like this instead:

  -z io,stat,"0,001",ip.addr==1.2.3.4