This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

IS it possible to create equations on wireshark filters

I'd like if it is possible to use wireshark filter to do equations. For example. If I have two fields with timestamps on a frame. Can I gete the difference between then, or add on to another? something like that? thanks in advance.

filter equation wireshark

asked 08 Aug '12, 05:41

higorsilvacomh
1●1●1●1
accept rate: 0%

One Answer:

The filters are used to either:

Select if a frame from the selected interface(s) is written to the capture output sink. These are called capture filters.
Select if a frame from the capture file is displayed in the Wireshark GUI. These are called display filters.

In both these cases the filter expressions return a yes/no that indicates if the frame passes the filter and should be captured/displayed as appropriate and do not return any other useful value in that respect.

If you wish to calculate inter-frame differences you'll have to resort to a tap or scripting the output of tshark.

answered 08 Aug '12, 06:24

grahamb ♦
19.8k●3●30●206
accept rate: 22%