Re: Editcap and timestamps

[Jeff Morriss <jeff.morriss.ws () gmail com>]

Wu Weidong wrote:
> Hi,
>
> Does editcap depend on packet timestamp in anyway? I was able to extract 
> specific packets using editcap on pcap files that were recorded from 
> live traffic, but was unable to extract any packets on processed pcap 
> files that have packet timestamps as 0.

It did, I think, until recently.  I can't remember if r34913 fixed it 
(in which case 1.6 has the fix) or r37633 fixed it (in which case you'd 
need to try an automated build[1]).

[1] http://www.wireshark.org/download/automated/
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request () wireshark org?subject=unsubscribe