[Florent Deybach <fdeybach@xxxxxxxxxxxxxx>]

Hello everybody,

I am using tshark to get the protocol hierarchy on several PCAP files
with the following command:

For example:

#tshark.exe -qz io,phs -r file-00018.cap

The output is:

=============================================
Protocol Hierarchy Statistics
Filter: frame

frame                                    frames:26721 bytes:21836862
  eth                                    frames:26721 bytes:21836862
    ip                                   frames:26721 bytes:21836862
      tcp                                frames:25921 bytes:21675514
        http                             frames:11289 bytes:13681015
          short                          frames:11261 bytes:13679287
        data                             frames:765 bytes:232183
        ssl                              frames:5330 bytes:5761777
          short                          frames:4713 bytes:4972534
          unreassembled                  frames:597 bytes:787991
        short                            frames:1479 bytes:1337465
        tpkt                             frames:182 bytes:39858
        nbss                             frames:178 bytes:163832
          short                          frames:75 bytes:31104
          data                           frames:2 bytes:1510
        dns                              frames:32 bytes:12805
          short                          frames:32 bytes:12805
        smtp                             frames:59 bytes:27203
        rmi                              frames:14 bytes:5110
        unreassembled                    frames:24 bytes:4000
          dns                            frames:1 bytes:1423
            short                        frames:1 bytes:1423
        ssh                              frames:1 bytes:75
          short                          frames:1 bytes:75
        gtp                              frames:1 bytes:206
        ldap                             frames:5 bytes:3204
          short                          frames:4 bytes:3136
      udp                                frames:774 bytes:159268
        dns                              frames:711 bytes:145595
          short                          frames:687 bytes:144149
        kerberos                         frames:14 bytes:7435
          short                          frames:14 bytes:7435
        ntp                              frames:17 bytes:1530
          short                          frames:17 bytes:1530
        bootp                            frames:3 bytes:1026
          short                          frames:3 bytes:1026
        data                             frames:8 bytes:480
        nbns                             frames:9 bytes:1361
          short                          frames:8 bytes:1263
        snmp                             frames:8 bytes:974
          short                          frames:6 bytes:732
        cldap                            frames:1 bytes:237
          short                          frames:1 bytes:237
        malformed                        frames:1 bytes:60
        nbdgm                            frames:2 bytes:570
          short                          frames:2 bytes:570
      icmp                               frames:25 bytes:1926
        short                            frames:16 bytes:1256
      esp                                frames:1 bytes:154
============================================


As you can see, I captured the frames with tcpdump limiting the
captured frame size to 68 bytes so there are several frames that are
truncated.
That is why you can see under almost each protocol a "short" line.

The problem is that tshark seems to "forget" (or cannot classify)
several frames in the TCP frame count. But only in the TCP frames, not
UDPs.

When you take the total of TCP frames: "frames:25921", the sum of each
protocol in the TCP column immediately "under" the TCP column (without
"short") is only 19359

http                  frames:11289 bytes:13681015
data                 frames:765bytes:232183
ssl                   frames:5330bytes:5761777
short                frames:1479bytes:1337465
tpkt                  frames:182 bytes:39858
nbss                frames:178 bytes:163832
dns                  frames:32 bytes:12805
smtp                frames:59 bytes:27203
rmi                   frames:14 bytes:5110
unreassembled	frames:24 bytes:4000
ssh	                frames:1 bytes:75
gtp	                frames:1 bytes:206
ldap	                frames:5 bytes:3204

So there are 25921 - 19359 = 6562 missing frames.

I have the same behavior with 20 other files containing each 2.000.000
frames, there are 500.000 TCP frames that are not counted on
average....

Do you see where the problem is? (I hope I made myself clear ;))

Thanks!

Florent