I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command:
tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack
After some packet in the trace file (when I started having duplicate ACKs) I get something like:
6289 1,1 6290 6291 1,1 6292 6293 1,1 6294 6295 1,1 6296 6297 1,1 6298 6299 1,1
Based on the tshark's man page, the
, is used for:
-E <field print option> "other options" aggregator=,|/s|<character> Set the aggregator character to use for fields that have multiple occurrences. If , a comma will be used (this is the default), if /s, a single space will be used. Otherwise any character that can be accepted by the command line as part of the option may be used.
I currently don't understand why do I get two (comma-separated) numbers, an what do they mean. How is it possible to have multiple occurrences?