First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Problem tshark io,stat interval

Hi, I'm trying to get 1ms statistics for all packets with vlan priority = 2 in my capture. I use the command

tshark -n -q -r test.pcap -z "io,stat,0.001,vlan.priority==2"

But I get the following error:

tshark: invalid "-z io,stat,<interval>[,<filter>][,<filter>]...0" argument

The command with 1 second interval works fine. (tshark -n -q -r test.pcap -z "io,stat,1,vlan.priority==2")

jcabrejas006's avatar
3
jcabrejas006
asked 2019-02-14 09:03:34 +0000
edit flag offensive 0 remove flag close merge delete

Comments

What version of tshark are you running? Please provide tshark -v output. (This works fine for me using 2.6.6 on Windows 10.)

cmaynard's avatar cmaynard (2019-02-14 16:04:24 +0000) edit
more
  • delete

This is the output for tshark -v. I work on a Linux system, Ubuntu 18.04

TShark (Wireshark) 2.6.6 (Git v2.6.6 packaged as 2.6.6-1~ubuntu18.04.0)

Copyright 1998-2019 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with GLib 2.56.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua
5.2.4, with GnuTLS 3.5.18, with Gcrypt 1.8.1, with MIT Kerberos, with MaxMind DB
resolver, with nghttp2 1.30.0, with LZ4, with Snappy, with libxml2 2.9.4 ...
(more)
jcabrejas006's avatar jcabrejas006 (2019-02-15 08:49:50 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

This looks like a locale problem to me. For example, LC_NUMERIC=es_ES.UTF-8 may mean the decimal point in 0.001 is being interpreted as a comma. Here's my locale:

LANG=
LC_CTYPE="C.UTF-8"
LC_NUMERIC="C.UTF-8"
LC_TIME="C.UTF-8"
LC_COLLATE="C.UTF-8"
LC_MONETARY="C.UTF-8"
LC_MESSAGES="C.UTF-8"
LC_ALL=

Maybe you could try changing your locale to see if that helps?

cmaynard's avatar
11.1k
cmaynard
answered 2019-02-15 15:07:49 +0000
edit flag offensive 0 remove flag delete link
more

Comments

That was it!! Thank you so much for your help!

jcabrejas006's avatar jcabrejas006 (2019-02-19 09:24:30 +0000) edit
more
  • delete

I'm glad this worked for you, but I think it would be worth opening a bug report. You shouldn't have to be forced to change your locale for this to work. That is, if your locale uses a comma for a decimal separator, then 0,001 should work. In this case, I think it makes sense that it fails with 0.001.

cmaynard's avatar cmaynard (2019-02-19 13:29:44 +0000) edit
more
  • delete

Ok, I'll do it. Where do I go to open the bug report?

jcabrejas006's avatar jcabrejas006 (2019-02-20 08:54:34 +0000) edit
more
  • delete

https://bugs.wireshark.org/bugzilla/

cmaynard's avatar cmaynard (2019-02-20 13:34:46 +0000) edit
more
  • delete

There was a bug report already open, and it looks like they fixed it.

https://bugs.wireshark.org/bugzilla/s...

jcabrejas006's avatar jcabrejas006 (2019-02-22 09:06:07 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer