I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command:

tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack

After some packet in the trace file (when I started having duplicate ACKs) I get something like:

6289    1,1
6291    1,1
6293    1,1
6295    1,1
6297    1,1
6299    1,1

Based on the tshark's man page, the , is used for:

-E <field print option>

   "other options"       

   aggregator=,|/s|<character> Set the aggregator character to use 
   for fields that have multiple occurrences. If , a comma will be
   used (this is the default), if /s, a single space will be used. 
   Otherwise any character that can be accepted by the command line 
   as part of the option may be used.

I currently don't understand why do I get two (comma-separated) numbers, an what do they mean. How is it possible to have multiple occurrences?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.