I need the response time for each CCA paquet, so i'm trying with: tshark -r TraficoDiameter.pcap -d tcp.port==6553,diameter -R "diameter.cmd.code == 272 && diameter.resp_time" -e diameter.resp_time -e frame.time_epoch -E separator=";" -T fields this result is giving me: resp_time;epoch:time, but some packets have several CCR so the result is: resp_time,resp_time,resp_time,...;epoch:time there is a way to separate all resp_time with his own epoch time? asked 23 Apr '13, 10:48  fachav2 |
One Answer:
Please have a look at my answer to the following question.
It contains a perl script to solve a similar problem. Maybe you can adapt it for your scenario. If that does not work, please check the Lua code in the answer of @helloworld. Regards answered 17 Jul '13, 15:38  Kurt Knochner ♦ edited 17 Jul '13, 16:10 |
Did you manage to work this out?
I'm also interested in this case.
not yet, I`m thinking there is no solution for this, maybe with a post-result script. If you get something please tell to all here