i'm trying to figure out how to look up the recorded information on wireshark from a particular date and time. the information i need is very important can anyone help with step by step instructions, guidance, anything? Please any help would be greatly appreciated
Hi
I like using the frame.time field for this.
You should see this field under Frame in the Packet details pane if your capture has Ethernet frames in it.
You can see packets for certain times using these filters:
Packets received ON or AFTER December 28, 2018 16:45:
frame.time >= "Dec 28, 2018 16:45:00.000000000"
Packets received BETWEEN 16:45 and 17:45 on December 28, 2018:
(frame.time >= "Dec 28, 2018 16:45:00.000000000" ) && (frame.time <= "Dec 28, 2018 17:45:00.000000000")
Hopefully you know what the time was on the capture device (precision, timezone, etc.) because that is the time used for that field.
Cheers,
JFD
thank you so much. im not real computer savvy all the verbiage confuses me as its always changing or i don't remember how to do something i like to have a visual guide or instruction so i can refer back and this will help alot will definitely try this.. so very appreciated thanks again :)
Asked: 2019-06-10 21:35:51 +0000
Seen: 403 times
Last updated: Jun 10 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
