Ask Your Question
0

What is the syntax for wireshark custom column

asked 2017-11-13 16:20:40 +0000

Pheonix7 gravatar image

I want to calculate the time difference between 2 consecutive packets (and apply this for the whole pcap file), and have this shown as a custom column. What is the syntax i need to use to put in the "Field name" to calculate and show this information?

Thank you!

edit retag flag offensive close merge delete

Comments

Why do you think you need a custom column for this? You can set the time display format (View -> Time Display format) to show the delta between either the previously captured packet or the previously displayed packet.

grahamb gravatar imagegrahamb ( 2017-11-13 17:11:41 +0000 )edit

Also you can right click that time in every packet inside the frame header and select „apply as column“

Christian_R gravatar imageChristian_R ( 2017-11-13 17:16:24 +0000 )edit

1 Answer

Sort by » oldest newest most voted
1

answered 2017-11-13 20:26:11 +0000

Jaap gravatar image

As commented, you don't need to add a custom column for this, but if you must, then use:

frame.time_delta

as your custom column field.

edit flag offensive delete link more

Comments

Thank you guys! As per your advice I created a new column and made it type "Delta time".

Pheonix7 gravatar imagePheonix7 ( 2017-11-14 09:30:56 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2017-11-13 16:20:40 +0000

Seen: 52 times

Last updated: Nov 14