This is our old Q&A Site. Please post any new questions and answers at

Here is what I tried:

tshark -r test.pcap -T fields -e frame.time_relative > file.csv

And here is the csv file I got:

  • frame.time_relative
  • 0
  • 0.000128
  • 0.000315
  • 0.000407
  • 0.010027

I want this format to be a real time format. for example: 16:20:35 (hour:minute:second)

Any idea please...

asked 02 Dec '13, 23:28

Eliza%20Rana's gravatar image

Eliza Rana
accept rate: 0%

edited 03 Dec '13, 08:12

cmaynard's gravatar image

cmaynard ♦♦

My answer to this question over at should help you.

permanent link

answered 03 Dec '13, 08:19

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

Thanks cmaynard.

(03 Dec '13, 08:32) Eliza Rana

You're welcome. Now please go delete your duplicate questions.

(03 Dec '13, 08:33) cmaynard ♦♦

Raksmey, Eliza, or whatever your name may be

really not meant as an offense,

BUT, why do you open 3!! questions for the identical problem?

This is a Q&A site, with the purpose to get answers for questions and to search for answers to similar problems. If you clutter the site with questions, you will not help others to find an answer to their problems, as all your redundant, open questions will distract/confuse them.

The reason why you don't get that many answers to your questions is pretty simple. It is obvious, that your are trying to get the work done for your homework, by other people. You are asking for complete solutions, like: 'please draw CDR of TCP frames with R'. Why do you think people would do that? It's quite some work and foremost it is your work as it is your homework.

If you promise the following things, I promise to give you some hints how to finish your homework.

  • you promise to stop creating questions over and over again for the same homework problem
  • you promise to consolidate all your questions in one new question
  • you promise to add information to that question what you have already tried and what problems you are still facing
  • you promise to delete your other, redundant questions

If all that happens

  • I promise to give you some hints for your homework problems. However: don't expect to get any (R) code or a colored PDF with your letterhead and all the answers for your homework!!


permanent link

answered 03 Dec '13, 03:09

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 03 Dec '13, 03:09

I'm sorry for this

(03 Dec '13, 04:22) Eliza Rana

no need to be sorry. You can help others to help you, by asking the right questions in the right way ;-))

So, regarding your time problem, you have these options:

tshark -nr input.pcap -T fields -e frame.time

which will print the absolute date/time in the following format

Dec  3, 2013 15:04:01.154144000
Dec  3, 2013 15:04:02.678225000
Dec  3, 2013 15:04:02.778029000

tshark -nr input.pcap -T fields -e frame.time_relative

which will print the absolute date/time in 'Unix time', which is seconds passed since 1.1.1970 00:00:00.


tshark -nr input.pcap -T fields -e frame.time_relative

which will print the relative time (in seconds) since the beginning of the capture file.


Those time formats are all described in the docs

So, to solve your 'CDR graphing problem', you could use frame.time and remove the date part (with a script) or frame.time_relative and convert the seconds to hh:mm:ss (with a script).


(03 Dec '13, 06:33) Kurt Knochner ♦

Thank you!

(03 Dec '13, 08:32) Eliza Rana
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 02 Dec '13, 23:28

question was seen: 4,808 times

last updated: 03 Dec '13, 08:33

p​o​w​e​r​e​d by O​S​Q​A