Re: tshark display filter / time

["j.snelders" <j.snelders () telfort nl>]

Hi Stuart,

Use frame.time_delta and frame.time_relative:
$ tshark -r Copylmt_04.pcap -T fields -e frame.number -e frame.time_delta
-e frame.time_relative -E header=y | head
frame.number    frame.time_delta        frame.time_relative
1       0.000000000     0.000000000
2       0.160305000     0.160305000
3       0.000057000     0.160362000
4       0.000197000     0.160559000
5       0.261759000     0.422318000
6       0.272807000     0.695125000
7       0.000706000     0.695831000
8       0.000069000     0.695900000
9       0.000630000     0.696530000

My best
Joke

On Sun, 30 Oct 2011 07:03:50 -0700 Stuart Kendrick wrote:
> How do I persuade tshark to display both Relative Time and Delta Time?
>
> Obviously, 'time.delta' and 'time.relative' don't mean much ...
>
> guru> tshark -r sample.pcap -T fields -e frame.number -e time.delta -e time.relative
> -e ip.src -e ip.dst
>
> frame.number  time.delta  time.relative  ip.src         ip.dst
> 1                                        10.12.5.123    10.12.18.116
> 2                                        10.12.18.116   10.12.5.123
> 3                                        10.12.5.123    10.12.18.116
> 4                                        10.12.18.116   10.12.5.123
>
> --sk
>
> Stuart Kendrick
> FHCRC


       


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe