This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm using tshark to extract specific TCP streams and write that to an output pcap file using the -w option.

But, the frames in the output pcap do not have any timestamps or delta times (they're all zero while in the original pcap there are timestamps and delta times for the frames).

Is there any way to ensure that the original timestamps (from the original pcap file) are preserved in the output pcap?

I'm using TShark 1.10.5 (SVN Rev 54262 from /trunk-1.10) on MacOS. Here's what I'm doing:

tshark -r test.pcap -2 -R "tcp.stream == 53" -w test_53.pcap

Thanks!

asked 10 Feb '14, 18:35

wwwalker's gravatar image

wwwalker
21226
accept rate: 0%


the frames in the output pcap do not have any timestamps or delta times (they're all zero while in the original pcap there are timestamps and delta times for the frames).

That is what is technically known as a "bug". Please file it as a bug on the Wireshark Bugzilla; if you can attach your original pcap file for testing purposes, that would be good. (If not, please run the file command on it and show the results, just so we know what file type the input file is - it might, for example, be a pcap-ng file rather than a pcap file, the .pcap nonwithstanding).

permanent link

answered 10 Feb '14, 21:02

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

(11 Feb '14, 15:32) wwwalker
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×238
×62
×22

question asked: 10 Feb '14, 18:35

question was seen: 3,393 times

last updated: 11 Feb '14, 15:32

p​o​w​e​r​e​d by O​S​Q​A