Wireshark mailing list archives
Re: getting absolute time of packet
From: Jaap Keuter <jaap.keuter () xs4all nl>
Date: Fri, 28 Dec 2012 00:36:11 +0100
Hi,The 'timestamp' you are referring to is actually a relative timestamp with respect to the first frame in the capture file. Therefore your filtered capture file will always have the 0.0000 timestamp on the first frame.
Thanks, Jaap On 12/27/2012 01:15 PM, yuva raj wrote:
hi, I am using tethereal. I captured few packets, in which 10th packet is tcp with timestamp 1.2436. I set a filter for tcp and saved the filtered packets to another file. The resultant file the tcp packet as first packet and timestamp as 0.0000 Can someone tell me how to save the filtered packets and keep the timestamp intact. I want to get the timestamp 1.2436, as it is in my resultant file. I tried the options in tethereal '-t a' and '-t r', but both resulted the same, i.e. timestamp 0.0000 Thanks in advance. uv.
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- getting absolute time of packet yuva raj (Dec 27)
- Re: getting absolute time of packet Bill Meier (Dec 27)
- Re: getting absolute time of packet Jaap Keuter (Dec 27)