Verifying counter falls in particular range or not in a packet capture

Question

I have got counters based on 2 sec interval.

• I need to verify that the count should be in range 1200 to 1600. Is there any way we can do it without parsing whole output?

• If for any particular time interval, the count doesn't fall into matching range, some error/warning message should get printed.

• Is there any method to get average for this counters?

# tshark -r q4-mme.pcap -qz io,stat,2,"COUNT(frame.time)frame.time"
===================================================================
IO Statistics
Interval: 2.000 secs
Column #0: COUNT(frame.time)frame.time
                |   Column #0
Time            |          COUNT
000.000-002.000              1241
002.000-004.000              1272
004.000-006.000              1315
006.000-008.000              1371
008.000-010.000              1195
010.000-012.000              1299
012.000-014.000              1305
014.000-016.000              1391
016.000-018.000              1463
018.000-020.000              1454
020.000-022.000              1392
022.000-024.000              1438
024.000-026.000              1362
026.000-028.000              1491
028.000-030.000              1392
030.000-032.000              1422
032.000-034.000              1425
034.000-036.000              1486
036.000-038.000              1449
038.000-040.000              1487
040.000-042.000              1402
042.000-044.000              1420
044.000-046.000              1330
046.000-048.000              1458
048.000-050.000              1420
050.000-052.000               144
===================================================================

Please let me know how can I achieve the desired results.

Answer 1

I am not familiar with python. But here is an attempt using awk. You may call it from python using appropriate system commands.

Verify the count range between 1200 to 1600

awk '( $1~/[0-9]+\.[0-9]+-[0-9]+\.[0-9]+/ && ($2<1200||$2>1600) ) {print $2}' file

Output:

1195
144

Calculate Average

awk '$1 ~ /[0-9]+\.[0-9]+-[0-9]+\.[0-9]+/ {total+=$2; cnt++;} END {printf "Average = %.2f\n", total/cnt}' file

Output:

Average = 1339.38