Wireshark-users: [Wireshark-users] tshark display filter / time
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stuart Kendrick <skendric@xxxxxxxxx>
Date: Sun, 30 Oct 2011 07:03:50 -0700
How do I persuade tshark to display both Relative Time and Delta Time?

Obviously, 'time.delta' and 'time.relative' don't mean much ...

guru> tshark -r sample.pcap -T fields -e frame.number -e time.delta -e time.relative -e ip.src -e ip.dst

frame.number  time.delta  time.relative  ip.src         ip.dst
1                                        10.12.5.123    10.12.18.116
2                                        10.12.18.116   10.12.5.123
3                                        10.12.5.123    10.12.18.116
4                                        10.12.18.116   10.12.5.123

--sk

Stuart Kendrick
FHCRC