Hello, I couldn't find any help for this on the Internet and here so here I go ! Some of my profiles have the Delta and TCP Delta columns. They both have a display format of nanoseconds, which is unneccessary to me. It's not much, but it would be cleaner for me if it stopped at milliseconds. My regular time colums can be easily changed via 'View - Time display format' , but I'm really looking for time format for these 2 specific columns. Is there a way I can do this ? Thanks for your help asked 03 May '17, 12:09  jerioux edited 03 May '17, 12:10 |
2 Answers:
You can add an additional "Delta time" column. To do so go to 'Preferences' -> 'Appearance' -> 'Columns'. Click the '+' and in 'Type' drop-down list choose 'Delta time displayed' or 'Delta time'. These two types respect the configured time display format. For 'TCP Delta' I'm not sure which field you mean. answered 04 May '17, 11:15  Uli |
For TCP Delta time you need to go to Packet Detail in the main Wireshark window. Right click on Transmission Control Protocol--> Protocol Preferences --> Calculate Conversation Time Stamp When you enable the above option, you will see an additional field "Timestamp" in the Detail section Select the second option Time Since Previous Frame in this TCP stream--> Right click --> Apply As column Keep the Time Column, Time Delta and TCP Delta column Adjacent to each other for ease of use and viewing Hope that helps answered 04 May '17, 20:42  deepacket Hello Deepacket, I already have this column, the same way you explained :) However the problem I reported for this specific column is that it goes up to nano seconds, and it's impossible to put it in milliseconds like the other Delta columns, which follows the time reference. Have a nice day, (05 May '17, 05:24) jerioux |
You solved my issue for the Delta!
I found something really interesting following that:
I used to have a column that was custom type with field name: frame.time_delta. This does EXACTLY the same job as the type 'Delta Time like you suggested but the latest is working with the timestamps we use. The one I used was stucked on nanoseconds. I corrected my column and it's now showing in milliseconds.
For the TCP Delta, I meant the filter: tcp.time_delta I search for that column in the type ''Delta time(conversation)'' but nothing is displayed. I found out on the internet this is a known bug in Wireshark. So I'll just have to work with it at a nano level.
It seems like whenever we are using ''custom'' type with a specific filter related to time, the timestamps are always at nano.