Hello,
Thanks a lot Mr. Harris. I use a simple packet generator to send a controlled
number of TCP (IPv4) packets. But the number of packets I send is different
from the number of packets captured using Ethereal. I send 5000 packets in a
burst of 200 packets each time.
When I use the filter and go and see the packet count in "Data in Filtered
PAckets" section, it shows 3595..there seems to be a packet loss somewhere.
I start Ethereal first with the filter and then start injecting packets.
So, I ran Ethereal on the source machine from where I am sending the packets,
but here also, the packet count is 3595. Does anybody know why this is
happening.
Also, what is the difference between the packet count in the "Data" section and
the Packet Count in "Data in Filtered Packet Section"
Help truly appreciated.
thanks.
Suhail.
Quoting Guy Harris <guy@xxxxxxxxxxxx>:
> On Wed, Oct 22, 2003 at 02:20:54AM -0700, Suhail Hussain wrote:
> > What kind of a filter should be used in Ethereal if one needs to find out
> the
> > number of packets generated from a particular source to a particular
> > destination.
>
> A filter that compares the source and destination addresses, for
> whatever protocol this is (Ethernet? IPv4? IPv6? IPX?), against the
> values you're interested in.
>
> > Please let me know what string expression should be used
>
> We can't do that without knowing what type of address it is. If, for
> example, it's IPv4, it'd be
>
> ip.src == 16.66.66.66 && ip.dst == 16.55.55.55
>
> or something such as that (names can also be used). However, for IPv6,
> or Ethernet, or Token Ring, or IPX, or..., it'd be different.
>
> > And is there a counter in Ethereal which will give the number of these
> > packets.
>
> Once you've filtered the packets, Ethereal 0.9.15 will show you that
> count if you pop up the capture summary - select "Summary" from the
> "Tools" menu, and look for "Packet count:" in the "Data in filtered
> packets" section.
>