I need something allowing "field.name == <value>" to be counted. Typical
use: count occurrences of a sub-PDU type (or PDU subtype)... which requires
the ability to specify the value to the field name. An obvious extension is
then to provide filter expressions, already used in Ethereal for colorizing
the display or for packet filtering. I really want to count the occurrences
of say:
ip.src == 10.20.30.40 && udp.port == 1234
ip.addr == 10.20.30.40 && wtp.pdu_type == 5
Which is only possible today by filtering the packets, marking all frames
and then save the marked packets to a new file :) Note that I want both the
number of matching frames and the number of occurrences, as many protocols
provide PDU concatenation.
I hope this clarifies my wish list item!
Regards,
Olivier
-----Original Message-----
From: Guy Harris
Subject: Re: [Ethereal-dev] Wish List: count the occurrences of <display
filterexpression>
On Oct 9, 2003, at 5:57 AM, Ronnie Sahlberg wrote:
> IO STAT for both ethereal and tethereal can already do this.
> see manpage
>
> It can however only count the number of times a specific field occurs
> in the
> captures, not how many
> times an expression evaluates to true.
The expression
foo.bar
evaluates to true if "foo.bar" is present in a frame.
If IO-stat allowed a filter expression, rather than just a field name,
to be specified in the "advanced..." graphs, for COUNT(*), it would, I
think, be backwards compatible, as per the previous paragraph.