1

I want to write a script where I need to verify the final result (pass/fail) based on a graph generated in wireshark.

  • In wireshark, under "Statistics" menu, "IO Graph" is there. We can give filter and generate graph based on it.

  • I tried finding command line option for getting details on graph. Basically, I need the count for which graph is getting generated, like count for a particular protocol message

Attaching reference screenshot :-

enter image description here

I tried following command which gives count based on time interval, but what I need is, count for a particular protocol message which is 6 for my case.

-bash-3.2$ tshark -q -nr rad_fun_010.pcap -t ad -z io,stat,1,"COUNT(frame.len)frame.len"

===================================================================
IO Statistics
Interval: 1.000 secs
Column #0: COUNT(frame.len)frame.len
                |   Column #0
Time            |          COUNT
000.000-001.000                 2
001.000-002.000                 0
002.000-003.000                 9
003.000-004.000                 0
004.000-005.000                 0
005.000-006.000                 0
006.000-007.000                 0
007.000-008.000                 2
===============================================

With "tshark io" related command, getting count might be possible, but couldn't get enough information on this. Can someone throw some light on how to achieve this?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.