This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello Sir, I want to copy displayed fields e.g. time and packet length only. I want to use only these fields for further processing of my dataset. How can I do that?

asked 08 Apr '12, 10:12

chandu85420's gravatar image

chandu85420
1111
accept rate: 0%


Have you looked at tshark, the command line version of Wireshark? Using the options -T fields -e frame.time_epoch -e frame.len gives you output of the form 1330082384.015475000 64 which is the frame time in seconds since the epoch (00:00:00 1/1/1970) and the length (on the wire) of the frame.

You can use any filterable fields with -e, in the GUI just click on the relevant part of the protocol in the packet tree and the field description and more importantly name, will be displayed in the status bar at the bottom left.

permanent link

answered 09 Apr '12, 05:43

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

alt text

Actually I want to copy field values as shown in the figure below. Timing at which packet was seen and length. My objective is to collect time and packet size only so that I can make dataset comprising these field value and nothing else. please help.

(09 Apr '12, 23:16) chandu85420
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×9

question asked: 08 Apr '12, 10:12

question was seen: 2,370 times

last updated: 09 Apr '12, 23:37

p​o​w​e​r​e​d by O​S​Q​A