tshark statistics with filters problem

After several hours I finally found out how to use those tshark statistics filters with the -z option. I couldn't find any clues in the documentation or on the net though, just found the solution by accident...

Even the example from the man page:
  -z 'io,stat,1,ip.addr=='
may not work!

What can happen is that the comma after the time value "1" is interpreted as the decimal delimiter, for a german locales setting for example, so the rest of the filter string is omitted.

Another example would be writing
  -z io,stat,0.001,ip.addr==
where tshark will complain that the time value must be >= 0.001, but in this case it really is = 0.001 (one might think).

Either do
export LANG=C
before or write something like this instead:
  -z io,stat,"0,001",ip.addr==

Vielen Dank! Hatte genau das gleiche Problem. Ging auf zwei Rechner mit der neusten Version nicht, aber auf einer älteren... Dank Ihres Posts ist nun klar, es liegt nicht an der Version, sondern an der Sprache des installierten Systems...
Post a Comment

<< Home

This page is powered by Blogger. Isn't yours?