Wireshark-users: [Wireshark-users] Question about frame.time_delta_displayed filter
From: Frank Pall <fpall77@xxxxxxxxx>
Date: Thu, 5 Feb 2009 03:27:35 -0800 (PST)
Hello,
i am analyzing a huge amount of packets,and i am interested in the usage of the frame.time_delta_displayed filter,but i am honestly not understanding what's happening...

I generate a UDP packet every 10ms,and i want to see if there are packets whose delta time exceeds a certain amount of time.
I attach a sample capture file,exaplining the steps i'm doing:
1)i start with a total of 313 captured packets
2)i set the first sample as time reference
3)i order the displayed packets by the deltatime:i can see a maximum delta time of 0.017989 and all other packets' delta time is less than 0.014
4)i set a filter equal to frame.time_delta_displayed>0.014 expecting to see a single packet
5)instead,i see about half of the total number of packets,with different delta times from the original ones (i.e.,packet number 54:without any filter,the delta time is 0.010407; with the filter on,it becomes 0.021125)

Wireshark version in 1.0.5 (SVN Rev 26954)

Probably i misunderstood the usage of the filter...Can you please explain me why this happens?

Thanks in advance!

PS:Just an additional off-topic question:is there some tool capable of building chart on captured packets?

Attachment: all.pcap
Description: Binary data