How to find the number of Pkt Lengths (1514) in a given Stream Index

edit

In case others are looking at the above answer, it won't work on Windows as it relies on utilities (wc, uniq) and options (the -rn to sort) that aren't available.

A PowerShell equivalent is:

tshark -r <file.pcap> -Y "tcp.stream==278 && tcp.len==1460" | Measure-Object -Line

or

tshark -r <file.pcap> -Y "tcp.stream==278" -T fields -e tcp.len | Group-Object -NoElement

Thanks for the powershell versions Graham, I still need to find some time to get familiar with PowerShell, as I do like the object oriented nature of PowerShell :-)

I had started down the PowerShell path last year and was rescued by WSL. :-)
https://docs.microsoft.com/en-us/wind...

Windows file system is at "/mnt/c" and alias ".exe" files to short name.

    $ pwd
    /mnt/c/Program Files/Wireshark
    $
    $ alias
    alias ls='ls --color=auto'
    alias nmap='nmap.exe'
    alias tshark='tshark.exe'
    $

WSL is certainly useful, but is quite a large sledgehammer to crack this nut.

Note that PowerShell Core is cross platform and is open source and available on multiple platforms.

Ha! Learn something everyday. Did not know about PowerShell for other operating systems. Thanks!