["j.snelders" <j.snelders@xxxxxxxxxx>]

Hi Stuart,

To check whether tshark is using TCP timestamps run:
$ tshark -G currentprefs | grep tcp.calculate_timestamps
#tcp.calculate_timestamps: FALSE

To enable TCP timestamps use:
tshark -r FS01.pcap -o tcp.calculate_timestamps:TRUE -R "(tcp.dstport==445)"
-qz io,stat,600,"MIN(tcp.time_delta)tcp.time_delta" -qz io,stat,600,"SUM(tcp.time_delta)tcp.time_delta"
-z io,stat,600,"MAX(tcp.time_delta)tcp.time_delta" -z io,stat,600,"AVG(tcp.time_delta)tcp.time_delta"
-z io,stat,600,"COUNT(tcp.time_delta)tcp.time_delta"

Output:
===================================================================
IO Statistics
Interval: 600.000 secs
Column #0: COUNT(tcp.time_delta)tcp.time_delta
                |   Column #0
Time            |          COUNT
000.000-600.000            343084
===================================================================

===================================================================
IO Statistics
Interval: 600.000 secs
Column #0: AVG(tcp.time_delta)tcp.time_delta
                |   Column #0
Time            |            AVG
000.000-600.000             0.028
===================================================================

===================================================================
IO Statistics
Interval: 600.000 secs
Column #0: MAX(tcp.time_delta)tcp.time_delta
                |   Column #0
Time            |            MAX
000.000-600.000            91.617
===================================================================

===================================================================
IO Statistics
Interval: 600.000 secs
Column #0: SUM(tcp.time_delta)tcp.time_delta
                |   Column #0
Time            |            SUM
000.000-600.000                 0
===================================================================

===================================================================
IO Statistics
Interval: 600.000 secs
Column #0: MIN(tcp.time_delta)tcp.time_delta
                |   Column #0
Time            |            MIN
000.000-600.000             0.000
===================================================================


Note
SUM(<field>) can only be used on named fields of integer type. This will
sum together every occurrence of this field's value for each interval.
http://www.wireshark.org/docs/man-pages/tshark.html
http://www.wireshark.org/docs/dfref/t/tcp.html

Best regards
Joke


On Sun, 06 Nov 2011 05:23:14 -0800 Stuart Kendrick wrote:
>I would like to sum the delta time between frames which match a filter
>
>In this example, CIFS traffic from a client to a server.
>
>I can do this in the GUI:
>Statistics, IO Graphs, Filter tcp.dstport==445, SUM tcp.time_delta,
>Style FBar, Tick interval 10 min, Unit Advanced
>
>
>But I'm wanting to use tshark instead.
>
>guru> tshark -nlr sample-cifs.pcap -R "(tcp.dstport==445)" -qz io,stat,600,"SUM
>(tcp.time_delta)tcp.time_delta"
>
>===================================================================
>IO Statistics
>Interval: 600.000 secs
>Column #0: SUM(tcp.time_delta)tcp.time_delta
>                |   Column #0    
>Time            |            SUM 
>000.000-600.000                 0 
>===================================================================
>
>Clearly, I'm fumbling something.  Suggestions?
>
>--sk
>
>Stuart Kendrick
>FHCRC