 | 1 | initial version |
(screenshots from Version 4.4.1 (v4.4.1-0-g575b2bf4746e) on Windows)
I can't confirm that your calculation assumptions are valid but can explain why the column doesn't work.
It would help if there was an error message/popup explaining why the entry field is invalid (red).
The Wireshark Display Filter Reference: Transmission Control Protocol shows the field types:
tcp.len TCP Segment Len Unsigned integer (32 bits) tcp.analysis.ack_rtt The RTT to ACK the segment was Time offset tcp.time_delta Time since previous frame in this TCP stream Time offset
Error message displayed in status line:
Error message when opening expert info table:
The error message displayed with tshark:
C:\tshark -r ./"The Ultimate PCAP v20200224.pcapng" -2 -R "tcp.len / tcp.analysis.ack_rtt"
tshark: FT_UINT32 and FT_RELATIVE_TIME are not compatible.
tcp.len / tcp.analysis.ack_rtt
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There is no mechanism to "cast" fields in the filter language.
You could create a new field (and do all the casting/calculations) in a Lua plugin.
(WSDG: Chapter 10. Lua Support in Wireshark)
| | 2 | No.2 Revision |
(screenshots from Version 4.4.1 (v4.4.1-0-g575b2bf4746e) on Windows)
I can't confirm that your calculation assumptions are valid but can explain why the column doesn't work.
It would help if there was an error message/popup explaining why the entry field is invalid (red).
The Wireshark Display Filter Reference: Transmission Control Protocol shows the field types:
tcp.len TCP Segment Len Unsigned integer (32 bits) tcp.analysis.ack_rtt The RTT to ACK the segment was Time offset tcp.time_delta Time since previous frame in this TCP stream Time offset
Error message displayed in status line:
Error message when opening expert info table:
The error message displayed with tshark:
C:\tshark -r ./"The Ultimate PCAP v20200224.pcapng" -2 -R "tcp.len / tcp.analysis.ack_rtt"
tshark: FT_UINT32 and FT_RELATIVE_TIME are not compatible.
tcp.len / tcp.analysis.ack_rtt
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There is no mechanism to "cast" fields in the filter language.
You could create a new field (and do all the casting/calculations) in a Lua plugin.
(WSDG: Chapter 10. Lua Support in Wireshark)