|
I'd like if it is possible to use wireshark filter to do equations. For example. If I have two fields with timestamps on a frame. Can I gete the difference between then, or add on to another? something like that? thanks in advance. |
|
The filters are used to either:
In both these cases the filter expressions return a yes/no that indicates if the frame passes the filter and should be captured/displayed as appropriate and do not return any other useful value in that respect. If you wish to calculate inter-frame differences you'll have to resort to a tap or scripting the output of tshark. |
