Revision history [back]

Hi all,

I've got an interesting question from one of subscribers:

How to create display filter which will show only last 5 minutes in a capture file?

The best I could guess is to go to the last packet, remember it's "time from beginning" value, subtract 300, make a filter frame.time.relative <= computed_before_value

Is there an easier way?

Thanks

Hi all,

I've got an interesting question from one of subscribers:

How to create display filter which will show only last 5 minutes in a capture file?

The best I could guess is to go to the last packet, remember it's "time "seconds from beginning" value, subtract 300, make a filter frame.time.relative <= computed_before_value

Is there an easier way?

Thanks

Hi all,

I've got an interesting question from one of subscribers:

How to create display filter which will show only last 5 minutes in a capture file?

The best I could guess is to go to the last packet, remember it's "seconds from beginning" value, subtract 300, make a filter frame.time.relative <= computed_before_value

Is there an easier way?

If display filters had supported arithmetical operations I could've done the next: go to the last packet and apply a filter like frame.time.relative <= $frame.time.relative - 300 But this is not possible as I understand.

Thanks

Hi all,

I've got an interesting question from one of subscribers:

How to create display filter which will show only last 5 minutes in a capture file?

The best I could guess is to go to the last packet, remember it's "seconds from beginning" value, subtract 300, make a filter frame.time.relative frame.time_relative <= computed_before_value

Is there an easier way?

If display filters had supported arithmetical operations I could've done the next: go to the last packet and apply a filter like frame.time.relative frame.time_relative <= $frame.time.relative ${frame.time.relative} - 300 But this is not possible as I understand.

Thanks

Hi all,

I've got an interesting question from one of subscribers:

How to create display filter which will show only last 5 minutes in a capture file?

The best I could guess is to go to the last packet, remember it's "seconds from beginning" value, subtract 300, make a filter frame.time_relative <= computed_before_value

Is there an easier way?

If display filters had supported arithmetical operations I could've done the next: go to the last packet and apply a filter like frame.time_relative <= ${frame.time.relative} ${frame.time_relative} - 300 But this is not possible as I understand.

Thanks