Wireshark mailing list archives
General tip for creating display filters Re: Filtering based on time column
From: "COHEN, HARVEY S" <hc2182 () att com>
Date: Wed, 19 Nov 2014 15:22:58 +0000
An easy way to create a display filter is to select a packet that contains the value you want to filter. Click View, Packet Details. Expand the details view and find the line that contains the value you want to filter. For example, in the question below, find the line that contains "102.142566". In this case, the line will be Time since reference or first frame: 102.142566 seconds Right-click on this line, and select Prepare a Filter, Selected. In this case, the display filter will say frame.time_relative == 102.142566 Finally, edit the display filter to meet your need. In this case, edit to say frame.time_relative < 200 Harvey S. Cohen -----Original Message----- Message: 1 Date: Wed, 19 Nov 2014 03:40:31 +0000 (UTC) From: Rayne <hjazz6 () ymail com> To: "wireshark-users () wireshark org" <wireshark-users () wireshark org> Subject: [Wireshark-users] Filtering based on time column Message-ID: <1644948820.2368945.1416368431273.JavaMail.yahoo () jws10698 mail bf1 yahoo com> Content-Type: text/plain; charset="utf-8" Hi, Is there a way to filter for packets based on the time displayed in the Time column? For example, I have 5 packets that have the Time values "0.000000", "30.402577", "102.142566", "200.102244", "541.715466" and "612.841142". I want to filter for the first 3 packets, i.e. those with Time less than 200. How do I do that? Thank you. Regards,Rayne ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- General tip for creating display filters Re: Filtering based on time column COHEN, HARVEY S (Nov 19)