Display Filter Using Capture Date and/or Time Range?

Wireshark
1

Greetings,

Nowhere have I found a way to filter on the “Time” column. For example "time >= “2009-12-26 12:00:00.0” and time <= “2009-12-27 13:00:00.0”.

“daytime.string” does not work or I am formatting the string incorrectly. I cannot find any information on the format string but have attempted many variations.

“time” (the number of seconds since 1.1.1970) does not work either; “time > 0” displays nothing.

I know about how to display in different formats, but that is not a filter.

Similar to this topic in this forum is…

http://forums.meulie.net/t/display-filter-using-info-field/3829

2

Hello,

“daytime” and “time” are protocols.
So when you use them inside filter,
only “daytime” packet and “time” packet are displayed.
There is no link with the “Time” field displayed by wireshark.

I do not know how to do your filter.

Only thing I see :

  • mark the fist packet you want
  • mark the last packet you want
  • Save as and select “first to last marked”

Olivier

3

Duh. Thanks Olivier. That works. Just be sure to change the time format before opening a huge file.