This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a .pcap file which displays time (i.e. Arrival Time (for Wireshark and frame.time field for Tshark) in the top/physical/Frame layer) in the Apr 3, 2015 16:58:46.461897000 PDT.

I want to get this time in ISO format, like 2007-09-01 04:10:58.

Please note that I am not going to take a capture. I already have a capture file. I want to use Tshark to extract the field frame.time (which corresponds to Arrival Time in the top network layer in Wireshark) in a format like 2007-09-01 04:10:58, rather than a format like Apr 3, 2015 16:58:46.461897000 PDT.

Can I do that? How?

asked 28 Sep '16, 23:59

Jesss's gravatar image

Jesss
51141720
accept rate: 0%

1

Does this answer lack some information?

(29 Sep '16, 01:48) sindy

@sindy Yes, that solution involves adding an extra column and then taking the capture again. I can't take the capture again. I already have the captured data in the form of a .pcap file. Using Tshark, I have to read it and output the time in ISO format. (something like tshark -r myFile.pcap -T field -e frame.time > output.csv)

(29 Sep '16, 02:03) Jesss

The capture is not taken again. The Wireshark gui is used to add a column to the preferences which is then available for use by tshark.

If you're not specifying individual fields you can use -t ad or -t ud as shown in the tshark man page.

(29 Sep '16, 02:45) grahamb ♦

Running tshark with -r existing_capture_file_name instead of -i interface_name makes tshark read the existing file instead of taking a live capture and process it, according to the rest of the command line parameters, the same way as if it was a live capture.

(29 Sep '16, 07:49) sindy
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×62
×6
×3

question asked: 28 Sep '16, 23:59

question was seen: 3,469 times

last updated: 29 Sep '16, 07:49

p​o​w​e​r​e​d by O​S​Q​A