Hi, I am using TShark to export packets into excel. I need to print out the frame.time_delta_displayed for the packets before the filter is applied, However I only want to display the filtered packets. When I apply the filter, it changes the frame.time_delta_displayed, which I don't want to happen. Also, it can't be frame.time_delta tshark -r EthernetPacket1.pcap -o rtp.heuristic_rtp:TRUE -R "ipv6.dst == fd00:0:20:1::35 && amr.wb.toc.ft == 2" -T fields -e frame.time_delta_displayed > test.csv Here's a visual example of what I need. I am trying to filter out the ''30s': Original Data (frame.time_delta_displayed) 10 10 10 30 30 10 10 10 After Filter is applied: 10 10 10 70(30+30+10) 10 10 What I want to print: 10 10 10 10 10 10 If you can help me overcome this struggle I'm having, that would be great! Thanks asked 30 Jan '16, 18:06 atancr02 edited 30 Jan '16, 18:07 |
One Answer:
One possible way could be the of use instead of .Which should display the delta to the prev captured frame regardless whether displayed or not.answered 31 Jan '16, 00:31 Christian_R edited 31 Jan '16, 01:43 sindy |