Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a huge pcap file (many GBs) that I just can't load in wireshark. What I need is extracting bandwidth usage information, both total and per-protocol (in both incoming and outgoing direction), from it, and possibly graph it in a manager-friendly way.

Essentially, I need something that can process pcap files on the command line, and outputs usage statistics in a format suitable for visualization or usage with tools like rrdtool et al. Any advice welcome.

share|improve this question

1 Answer 1

You could try using the commandline version of wireshark tshark to extract the statistics. There are some examples in tshark's manpage under -z, e.g. io,stat,0,smb for all SMB packets.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.