tshark Packet Capture Count is Wrong

Question

When I run the Bash shell script below, the last line reports anywhere from 4 - 9 packets captured when it should report 29 - 34 packets captured, and it says "tshark: "RESULTS/C6-1/C6-1n10.pcap" appears to have been cut short in the middle of a packet."

If I run the tshark command embedded in the last line of this script from the command line after the scripts exits, the count is correct.

What am I doing wrong?

#!/bin/bash

tshark -i eth1 -a duration:245 -w RESULTS/C6-1/C6-1n10.pcap &> /dev/null &

# tshark seems to take some time to start. Allow for this.
sleep 10

# This takes 225 seconds to run.
mgen flush input C6-1/C6-1n10.mgn 2>&1 | tee RESULTS/C6-1/C6-1n10_mgen_log.txt

mgen_stats RESULTS/C6-1/C6-1n10_mgen_log.txt 20 20 224 20 239 60 2>&1 | tee RESULTS/C6-1/C6-1n10_mgen_analysis.txt

echo 2>&1 | tee -a RESULTS/C6-1/C6-1n10_mgen_analysis.txt
echo 2>&1 | tee -a RESULTS/C6-1/C6-1n10_mgen_analysis.txt
echo 2>&1 | tee -a RESULTS/C6-1/C6-1n10_mgen_analysis.txt

echo "There should be 29 - 34 messages from group 239.0.20.20. The actual count is:" 2>&1 | tee -a RESULTS/C6-1/C6-1n10_mgen_analysis.txt

# Ensure that the tshark instance we started above has time to exit before we start another instance.
sleep 20

echo `tshark -r RESULTS/C6-1/C6-1n10.pcap -R "ip.src == 104.4.20.2 && ip.dst == 239.0.20.20" | wc -l` 2>&1 | tee -a RESULTS/C6-1/C6-1n10_mgen_analysis.txt

Answer 1

You have no guarantees that the initial tshark instance has actually finished by that point. Rather than guessing at times and using sleep, use wait instead to force the script to wait for tshark to finish.

Waiting for background processes to finish before exiting script

Answer 2

1. Inappropriate packet count is returned when we use “wc -l” in tshark filter in TShark 1.12.1 version (working fine in TShark 1.10.1)

2. issue seen when we filter pcap file with "(ipv6.nxt ==17)" field in TShark 1.12.1 version (working fine in TShark 1.10.1)