This is our old Q&A Site. Please post any new questions and answers at


I am using TShark to export packets into excel. I need to print out the frame.time_delta_displayed for the packets before the filter is applied, However I only want to display the filtered packets. When I apply the filter, it changes the frame.time_delta_displayed, which I don't want to happen. Also, it can't be frame.time_delta

tshark -r EthernetPacket1.pcap -o rtp.heuristic_rtp:TRUE -R "ipv6.dst == fd00:0:20:1::35 && amr.wb.toc.ft == 2" -T fields -e frame.time_delta_displayed > test.csv

Here's a visual example of what I need. I am trying to filter out the ''30s':

Original Data (frame.time_delta_displayed)

10 10 10 30 30 10 10 10

After Filter is applied: 10 10 10 70(30+30+10) 10 10

What I want to print: 10 10 10 10 10 10

If you can help me overcome this struggle I'm having, that would be great!


asked 30 Jan '16, 18:06

atancr02's gravatar image

accept rate: 0%

edited 30 Jan '16, 18:07

One possible way could be the of use

instead of
.Which should display the delta to the prev captured frame regardless whether displayed or not.

permanent link

answered 31 Jan '16, 00:31

Christian_R's gravatar image

accept rate: 16%

edited 31 Jan '16, 01:43

sindy's gravatar image


Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Jan '16, 18:06

question was seen: 1,024 times

last updated: 31 Jan '16, 01:43

p​o​w​e​r​e​d by O​S​Q​A