Wireshark mailing list archives

General tip for creating display filters Re: Filtering based on time column


From: "COHEN, HARVEY S" <hc2182 () att com>
Date: Wed, 19 Nov 2014 15:22:58 +0000

An easy way to create a display filter is to select a packet that contains the value you want to filter. Click View, 
Packet Details. Expand the details view and find the line that contains the value you want to filter. For example, in 
the question below, find the line that contains "102.142566". In this case, the line will be
        Time since reference or first frame: 102.142566 seconds
Right-click on this line, and select Prepare a Filter, Selected. In this case, the display filter will say
        frame.time_relative == 102.142566
Finally, edit the display filter to meet your need. In this case, edit to say
        frame.time_relative < 200
Harvey S. Cohen

-----Original Message-----

Message: 1
Date: Wed, 19 Nov 2014 03:40:31 +0000 (UTC)
From: Rayne <hjazz6 () ymail com>
To: "wireshark-users () wireshark org" <wireshark-users () wireshark org>
Subject: [Wireshark-users] Filtering based on time column
Message-ID:
        <1644948820.2368945.1416368431273.JavaMail.yahoo () jws10698 mail bf1 yahoo com>
        
Content-Type: text/plain; charset="utf-8"

Hi,
Is there a way to filter for packets based on the time displayed in the Time column? For example, I have 5 packets that 
have the Time values "0.000000", "30.402577", "102.142566", "200.102244", "541.715466" and "612.841142". I want to 
filter for the first 3 packets, i.e. those with Time less than 200. How do I do that?
Thank you.
Regards,Rayne
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe


Current thread: