LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 01-28-2015, 08:53 PM   #1
project722
Member
 
Registered: Jun 2009
Posts: 53

Rep: Reputation: 0
How to use tshark or tcpdump to calculate bytes transmitted


I am using this command with tshark:

tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'

This essentially parses the pcap for only connections from the source ip and looks for the total length in bytes from each packet. I get output like this:

Total Length: 125

Total Length: 210

Total Length: 40

Total Length: 125

etc, etc....

What I need to do is take the numbers from Total Length and add them up so I can get an idea of how much data was passed over the wire in the time frame of the pcap from a single IP. Is there a command I can add on the end of the one I am using to do this?
 
Old 01-30-2015, 07:32 AM   #2
rtmistler
Moderator
 
Registered: Mar 2011
Location: USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 9,882
Blog Entries: 13

Rep: Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930
Write a script to loop while issuing that command, add a pipe using the cut function to remove the text for "Total Length:" and then add the numerical values together either by building an array or just adding iteratively to a variable. Each iteration of the loop you can output your total and then sleep for some period, say one second.

Not sure you can do it with just one command, although the whole loop can technically be a command typed at the command prompt, it's just easier to test, modify, and maintain if you make it a script. Plus you'll have to save the processed output to a variable as you add it up.
 
  


Reply

Tags
linux, network, pcap file, tcpdump, tshark



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
I've found tcpdump tagged as 'Installed' in PPM, why I can't find a tcpdump command ? illidan.modeler Puppy 1 09-07-2013 07:50 AM
determine my block size / calculate blks to bytes / centos 5.6 needsleep Linux - Newbie 1 06-25-2011 08:10 PM
Calculate usable bytes on a disk partition? dbrazeau Linux - Newbie 7 03-10-2010 10:42 PM
how to calculate the bytes-per-inodes value? z@ki Red Hat 3 02-24-2010 02:17 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 09:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration