Re: Filter retransmitted packets

[Sake Blok <sake () euronet nl>]

On 26 feb 2010, at 13:28, Adriana Hava wrote:
> I need to calculate the ratio of retransmitted packets to transmitted frames for each second.
> I know I can show only retransmitted packets in Wireshark using the filter wlan.fc.retry eq 1.
>
> I would be interested in identifying the retransmitted packets from the exported file that contains all the packets. 
> Is this possible ?
>
> Thanks!

You could use tshark, try the following:

tshark -r <file> -q -z io,stat,1,frame,wlan.fc.retry==1

You would get something similar to:

MacSake:~ sake$ tshark -r dns.cap -q -z io,stat,10,frame,dns.flags.response==0,dns.flags.response==1

===================================================================
IO Statistics
Interval: 10.000 secs
Column #0: frame
Column #1: dns.flags.response==0
Column #2: dns.flags.response==1
                |   Column #0    |   Column #1    |   Column #2    
Time            |frames|  bytes  |frames|  bytes  |frames|  bytes  
000.000-010.000    2560    231622   1281     97349   1279    134273 
010.000-020.000    2470    223506   1236     93936   1234    129570 
020.000-030.000    2334    211212   1168     88782   1166    122430 
===================================================================
MacSake:~ sake$ 

Cheers,
     Sake

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe