Ethereal-dev: RE: [Ethereal-dev] Wish List: count the occurrences of <display f ilterexpressio

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Fri, 10 Oct 2003 18:13:48 -0000
On Thu, 2003-10-09 at 17:47, Biot Olivier wrote:
> I need something allowing "field.name == <value>" to be counted. Typical
> use: count occurrences of a sub-PDU type (or PDU subtype)... which requires
> the ability to specify the value to the field name. An obvious extension is
> then to provide filter expressions, already used in Ethereal for colorizing
> the display or for packet filtering. I really want to count the occurrences
> of say:
> 
> 	ip.src == 10.20.30.40 && udp.port == 1234
> 	ip.addr == 10.20.30.40 && wtp.pdu_type == 5
> 
> Which is only possible today by filtering the packets, marking all frames
> and then save the marked packets to a new file :) Note that I want both the
> number of matching frames and the number of occurrences, as many protocols
> provide PDU concatenation.
> 
> I hope this clarifies my wish list item!
> 
> Regards,
> 
> Olivier
> 

tethereal -r file -R '<dfilter expression>' | wc -l

:)

But seriously, it could be added to the Summary window.

--gilbert