Skip to content

Instantly share code, notes, and snippets.

@pocc
Last active January 12, 2020 00:13
Show Gist options
  • Save pocc/3a5c085f4f9e6b4419875debbed91c57 to your computer and use it in GitHub Desktop.
Save pocc/3a5c085f4f9e6b4419875debbed91c57 to your computer and use it in GitHub Desktop.
Demonstrates that tshark will consistently lose some percentage of packets. Change sleep number as suits your needs.
#!/usr/bin/env bash
# Ross Jacobs 2020 Apache2
# Demonstrates that tshark will consistently lose some percentage of packets.
# Change sleep number as suits your needs.
#
# See also https://www.networkcomputing.com/networking/wireshark-packet-capture-tshark-vs-dumpcap
cd /tmp
tshark -q -w tshark.pcap & tshark_pid=$!
dumpcap -q -w dumpcap.pcap & dumpcap_pid=$!
# Other large file can be substituted here if link fails
curl -s http://ipv4.download.thinkbroadband.com/1GB.zip >/dev/null & curl_pid=$!
# Change sleep count to suit your needs
sleep 1000 && kill $tshark_pid $dumpcap_pid $curl_id
dumpcap_pkts="$(capinfos dumpcap.pcap | grep -oP 'packets = \K\d+')"
tshark_pkts="$(capinfos tshark.pcap | grep -oP 'packets = \K\d+')"
packets_lost="$(($dumpcap_pkts-$tshark_pkts))"
percent_loss="$(echo "100*(1.0 - ($tshark_pkts/$dumpcap_pkts))" | bc -l | awk '{printf "%f", $0}')%"
cat << EOF
=== Test Results ===
Dumpcap packets: $dumpcap_pkts
Tshark packets: $tshark_pkts
Packets lost: $packets_lost
Percent loss: $percent_loss
EOF
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment