Hello,
When I use a command like the following:
tshark -r file.pcap -t a -Tfields -e _ws.col.Time -e field2 -e field3 -e field4
It will print each line beginning with the time of capture, without a date:
15:19:37.268975802
This shows me the time with nanosecond precision, however I was wondering if there's any way to remove that part and show seconds only.
I can easily do this in Wireshark (View > Time Display Format > Seconds) but I couldn't find any way to do it with TShark even after reading the manpage.