I'd like if it is possible to use wireshark filter to do equations. For example. If I have two fields with timestamps on a frame. Can I gete the difference between then, or add on to another? something like that? thanks in advance.
asked 08 Aug '12, 05:41
The filters are used to either:
In both these cases the filter expressions return a yes/no that indicates if the frame passes the filter and should be captured/displayed as appropriate and do not return any other useful value in that respect.
If you wish to calculate inter-frame differences you'll have to resort to a tap or scripting the output of tshark.
answered 08 Aug '12, 06:24