Wireshark-dev: [Wireshark-dev] editcap broken?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jingshao Chen <jingshao@xxxxxxxxxx>
Date: Wed, 12 Dec 2007 09:03:06 -0800
Hi,

I am trying to change the timestamp of the packets in a pcap file with editcap. But it does not work. Is it broken or I used it wrong?

wireshark> editcap -t +100 test.pcap out.pcap 4635-4636
Add_Selected: 4635-4636
Inclusive ... 4635, 4636
wireshark>

After this, when I open out.pcap, the packets #4635 and #4636 were removed from the pcap file and that is it.

Thanks,
Jingshao Chen