 | 1 | initial version |
In this trace, I apply the duration field of the packet as a column.
the duration field? I'm not sure which exact field you're referring to, but let's say it's foo.duration. You might try using tshark instead. For example:
tshark -r file.pcap -T fields -E separator=, -E quote=d -e frame.number -e foo.duration
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.