Find the Min and Max Packet size in a PCAP file?

Question

I have got the Average Packet size by using capinfos. However, I have not find a way to get the minimum and maximum packet size in a pcap file.

Note: I don't need a GUI command. Just need a command that could be typed in the terminal (Linux or Mac). Like tshark.

Answer 1

You could display the packet sizes for all packets in the PCAP file, and then compute the min and max with awk in a single pass:

tshark -T fields -e frame.len -r in.pcap | awk 'BEGIN{min=1500; max=0}{if ($1<0+min) min=$1; else if($1>0+max) max=$1} END{print min; print max}'