 | 1 | initial version |
In this trace, I apply the duration field of the packet as a column.
the duration field? I'm not sure which exact field you're referring to, but let's say it's foo.duration. You might try using tshark instead. For example:
tshark -r file.pcap -T fields -E separator=, -E quote=d -e frame.number -e foo.duration