ethereal has a cool little-known feature: the -z option to generate statistics from a pcap file. For instance, here's how to get a count of how much traffic you saw every five minutes:
$ tethereal -q -r foo.pcap -z io,stat,300

IO Statistics
Interval: 300.000 secs
Column #0: 
                |   Column #0    
Time            |frames|  bytes  
000.000-300.000    3832    344880 
300.000-600.000    3744    336960 
600.000-900.000    2316    208440 
The query language is pretty bizarre and protocol specific but there are some useful analysis tools. There's also the proto,colinfo option which lets you select out arbitrary protocol columns to print in the text dump from tethereal.
  2005-11-26 18:44 Z