Ask Your Question

Revision history [back]

Either field can be used as a column and they will behave exactly as @Jasper said, but also, frame.time_delta_displayed cannot be (successfully) used in a display filter. Display filters change what is displayed, but frame.time_delta_displayed is based on what is displayed, so you end up with a circular reference. Wireshark won't show an error, but a comparison will not show any packets, regardless of what value you're comparing to. So you would think that "frame.time_delta_displayed > 0" would match all packets, but in fact it will show _no_ packets.