Ask Your Question

http.time using tshark [closed]

asked 2018-11-29 03:22:15 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.


http.time is calculated by Wireshark.

Can tshark calculate http.time? I mean a command like "tshark -r test.pcap -T fields -e http.time > test.pcap.tshark.txt" I need to use tshark and calculate http.time using tshark.

Best regards, Babak

edit retag flag offensive reopen merge delete

Closed for the following reason the question is answered, right answer was accepted by Babak
close date 2018-11-30 15:41:10.968631

1 Answer

Sort by ยป oldest newest most voted

answered 2018-11-29 06:55:59 +0000

Guy Harris gravatar image

updated 2018-11-29 06:56:35 +0000

An example of a command to use to calculate http.time with TShark is

tshark -r test.pcap -T fields -e http.time > test.pcap.tshark.txt


(It's calculated by the HTTP dissector in libwireshark, which is used both by Wireshark and TShark to dissect packets.)

edit flag offensive delete link more


It does not work.

Babak gravatar imageBabak ( 2018-11-29 13:32:22 +0000 )edit

tshark -r test.pcap -T fields -e http.time > test.pcap.tshark.txt

This command works in Windows, but it does not work in Linux. Why? Do you have any idea?

Babak gravatar imageBabak ( 2018-11-29 16:13:08 +0000 )edit

I updated my tshark in Linux to 2.2.5 and it is fine. I do not have any problem for calculating http.time in Linux.

Babak gravatar imageBabak ( 2018-11-30 15:40:36 +0000 )edit

Question Tools

1 follower


Asked: 2018-11-29 03:22:15 +0000

Seen: 468 times

Last updated: Nov 29 '18