Ask Your Question
0

Is it possible to filter to ignore capture before and after a particular time stamps?

asked 2018-04-22 15:52:41 +0000

SunMan gravatar image

updated 2018-04-22 18:58:40 +0000

Is it possible to filter to ignore captures before and after a particular time stamps?

I usually do this

ping Repro starts Repro Ends ping

so I know where I need to focus ( in between the ICMP) but I like to filter traces as much as possible and wondering if it is possible to just exclude captures before my first ping ends and last ping (ICMP Packets) starts.

Thank you ~SunMan

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-04-22 16:41:34 +0000

cmaynard gravatar image

If you're looking for a Wireshark display filter that only displays frames between your pings, you can do this using frame numbers. For example, suppose your 1st ping occurs at frame number 1000 and your 2nd ping occurs at frame number 2000, then you could use this:

(frame.number > 1000) && (frame.number < 2000)

You can also use timestamps to accomplish the same thing. For example:

(frame.time > "Apr  5, 2018 10:00:00") && (frame.time < "Apr  5, 2018 12:00:00")

TIP: So you don't have to manually type the entire filter, expand the frame details for the 1st ping packet and then right-click on the frame number or frame arrival time (or frame epoch time) and choose, "Prepare a Filter -> Selected". Do the same for the 2nd ping packet except right-click but choose, "Prepare a Filter -> ... and Selected" instead. After that, just change the equality == operators to > and <, respectively.

edit flag offensive delete link more

Comments

Perfect. that's exactly what I was looking for. thanks Omaynard.

SunMan gravatar imageSunMan ( 2018-04-22 19:02:42 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2018-04-22 15:52:41 +0000

Seen: 1,386 times

Last updated: Apr 22 '18