On Fri, Jul 10, 2009 at 10:16:10AM +1000, Ian Schorr wrote:
>
> I forgot to mention that if you don't want tshark to actually display any
> packets (just the stats table), you'll want to feed it a "display filter"
> that matches no packets. So you could do something like:
>
> tshark -r <file> -R "not frame" -z io,stat,1,"tcp.port==20 or
> tcp.port==21" (every packet matches the filter "frame" so a display
> filter of "not frame" basically says "display any packets")
Actually, that's what the -q option is for :-)
(ie tshark -r <file> -q -z io,stat,1,<filter> )
Cheers,
Sake