Home / server / Questions / 357708
In Process
persson
Asked: 2012-02-08 09:57:56 +0800 CST

Bandwith usage from pcap files

  • 772

I've got a huge pcap file (many GBs) that I just can't load in wireshark. What I need is extracting bandwidth usage information, both total and per-protocol (in both incoming and outgoing direction), from it, and possibly graph it in a manager-friendly way.

Essentially, I need something that can process pcap files on the command line, and outputs usage statistics in a format suitable for visualization or usage with tools like rrdtool et al. Any advice welcome.

bandwidth pcap

1 Answers

  1. You could try using the commandline version of wireshark tshark to extract the statistics. There are some examples in tshark's manpage under -z, e.g. io,stat,0,smb for all SMB packets.

    • 3