Ask Your Question

ray13's profile - activity

2023-11-03 19:50:03 +0000 received badge  Popular Question (source)
2022-12-08 17:50:02 +0000 marked best answer TShark timestamp precision

Hello,

When I use a command like the following:

tshark -r file.pcap -t a -Tfields -e _ws.col.Time -e field2 -e field3 -e field4

It will print each line beginning with the time of capture, without a date:

15:19:37.268975802

This shows me the time with nanosecond precision, however I was wondering if there's any way to remove that part and show seconds only.

I can easily do this in Wireshark (View > Time Display Format > Seconds) but I couldn't find any way to do it with TShark even after reading the manpage.

2022-12-08 17:50:02 +0000 received badge  Scholar (source)
2022-12-08 15:37:58 +0000 asked a question TShark timestamp precision

TShark timestamp precision Hello, When I use a command like the following: tshark -r file.pcap -t a -Tfields -e _ws.co