Ask Your Question

Precision in frame.time filtering

asked 2019-07-25 18:30:12 +0000

tskan gravatar image

Is there a way to write a display filter based on frame.time that ignores fractions of a second? I can make the frame list change precision, but the display filter still misses the frames I want to see because of the fractions in the data stream.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-07-25 19:06:19 +0000

cmaynard gravatar image

You could try using absolute time instead? Then you can use a filter such as:

frame.time >= "2019-07-24 11:00:00" and frame.time < "2019-07-24 12:00:00"

An easy way to do this is to first add an Absolute date, as YYYY-MM-DD, and time column under Edit -> Preferences -> Columns, and then you can just right-click on the time column contents of a frame that you're interested in and choose "Prepare a filter -> Selected".

After this, you'll then need to add quotes to the data (because there's apparently a Wireshark bug here that causes the data not to be quoted), remove the sub-seconds and adjust the comparison operator as needed. Copy/Paste/Tweak as necessary for the next range, or repeat with the last frame in the time range you're interested in.

edit flag offensive delete link more


Perfect! Using a range removes the need to ignore the precision. Great job! Thanks for the assist.

tskan gravatar imagetskan ( 2019-07-25 20:03:09 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2019-07-25 18:30:12 +0000

Seen: 657 times

Last updated: Jul 25 '19