tshark -r abc.pcap -q -z rtp,streams ========================= RTP Streams ======================== Start time End time Src IP addr Port Dest IP addr Port SSRC Payload Pkts Lost Min Delta(ms) Mean Delta(ms) Max Delta(ms) Min Jitter(ms) Mean Jitter(ms) Max Jitter(ms) Problems? 2.666034 60.446026 192.168.69.12 18892 192.168.68.111 26772 0x76EFFF66 g711A 2807 72 (2.5%) 0.011 20.592 120.002 0.001 0.074 2.430 X 0.548952 60.467686 192.168.68.111 26772 192.168.69.12 18892 0xA655E7B6 g711A 2215 106 (4.6%) 9.520 21.202 219.777 0.055 6.781 256.014 X ==============================================================
Get TShark to collect various types of statistics and display the result after finishing reading the capture file. Use the -q option if you’re reading a capture file and only want the statistics printed, not any per-packet information. Statistics are calculated independently of the normal per-packet output, unaffected by the main display filter. However, most have their own optional filter parameter, and only packets that match that filter (and any capture filter or read filter) will be used in the calculations. Note that the -z proto option is different - it doesn’t cause statistics to be gathered and printed when the capture is complete, it modifies the regular packet summary output to include the values of fields specified with the option. Therefore you must not use the -q option, as that option would suppress the printing of the regular packet summary output, and must also not use the -V option, as that would cause packet detail information rather than packet summary information to be printed.
tshark -z help可以打
tshark -z help
-z conv,tcp-z conv,ip-z conv,udp-z endpoints,type[,filter]-z expert,sip-z sip,stat-z ip_hosts,tree-z rtp,streams