Ask Your Question

Revision history [back]

In this trace, I apply the duration field of the packet as a column.

the duration field? I'm not sure which exact field you're referring to, but let's say it's foo.duration. You might try using tshark instead. For example:

tshark -r file.pcap -T fields -E separator=, -E quote=d -e frame.number -e foo.duration