Ask Your Question

What is the syntax for wireshark custom column

asked 2017-11-13 16:20:40 +0000

Pheonix7 gravatar image

I want to calculate the time difference between 2 consecutive packets (and apply this for the whole pcap file), and have this shown as a custom column. What is the syntax i need to use to put in the "Field name" to calculate and show this information?

Thank you!

edit retag flag offensive close merge delete


Why do you think you need a custom column for this? You can set the time display format (View -> Time Display format) to show the delta between either the previously captured packet or the previously displayed packet.

grahamb gravatar imagegrahamb ( 2017-11-13 17:11:41 +0000 )edit

Also you can right click that time in every packet inside the frame header and select „apply as column“

Christian_R gravatar imageChristian_R ( 2017-11-13 17:16:24 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2017-11-13 20:26:11 +0000

Jaap gravatar image

As commented, you don't need to add a custom column for this, but if you must, then use:


as your custom column field.

edit flag offensive delete link more


Thank you guys! As per your advice I created a new column and made it type "Delta time".

Pheonix7 gravatar imagePheonix7 ( 2017-11-14 09:30:56 +0000 )edit


Like frame.time_delta, can i add/create custom frame_field_delta. Is that possible.

Regards, S.Senthil

Senthil gravatar imageSenthil ( 2018-10-12 14:38:18 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-11-13 16:20:40 +0000

Seen: 2,167 times

Last updated: Nov 14 '17