I am using this command with tshark:

tshark -r pcapfile "tcp and ip.src==" -T text -V -x | grep 'Total Length'

This essentially parses the pcap for only connections from the source ip and looks for the total length in bytes from each packet. I get output like this:

Total Length: 125

Total Length: 210

Total Length: 40

Total Length: 125

etc, etc....

What I need to do is take the numbers from Total Length and add them up so I can get an idea of how much data was passed over the wire in the time frame of the pcap from a single IP. Is there a command I can add on the end of the one I am using to do this?


You could pipe to awk with something like:

awk '{totalbytes+=$3}END{printf("Total bytes: %d\n",totalbytes)}'

Just divide by 1024 to get kB if you prefer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.