Display Filter Using Capture Date and/or Time Range?



Nowhere have I found a way to filter on the “Time” column. For example "time >= “2009-12-26 12:00:00.0” and time <= “2009-12-27 13:00:00.0”.

“daytime.string” does not work or I am formatting the string incorrectly. I cannot find any information on the format string but have attempted many variations.

“time” (the number of seconds since 1.1.1970) does not work either; “time > 0” displays nothing.

I know about how to display in different formats, but that is not a filter.

Similar to this topic in this forum is…




“daytime” and “time” are protocols.
So when you use them inside filter,
only “daytime” packet and “time” packet are displayed.
There is no link with the “Time” field displayed by wireshark.

I do not know how to do your filter.

Only thing I see :

  • mark the fist packet you want
  • mark the last packet you want
  • Save as and select “first to last marked”



Duh. Thanks Olivier. That works. Just be sure to change the time format before opening a huge file.