This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

create display filter based on frame.time_delta_displayed field

0

hi,

I am trying to create a display filter which will select all packets that have a specific time delta to the previously displayed packet. I have tried for example frame.time_delta_displayed > 0.1 or frame.time_delta_displayed==0.00472000 which is a value I can see in one of the packets in the capture, yet it still does not select anything. What am I missing?

Any help appreciated.

Jeannette

asked 05 May '17, 23:14

Jeannette54365's gravatar image

Jeannette54365
6112
accept rate: 0%


One Answer:

1

Have a close look at frame 1. There the time_delta_displayed is 0, so doesn't match, so isn't displayed. Now frame 2. Since frame 1 isn't displayed, the time_delta_displayed is 0, so isn't displayed. Now frame 3, ... ad infinitum.

So you have to get things started by at least displaying the first frame, e.g. prefix the filter by "frame.number==1 ||"

answered 06 May '17, 01:00

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks Jaap, that looks a bit better, still not a 100% there, but haven't got time right not to progress further.

Wasn't able to vote, I don't have enough points apparently.

(09 May '17, 05:21) Jeannette54365

Your "answer" has been converted to a comment as that's how this site works. Please read the FAQ for more information.

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(09 May '17, 05:24) grahamb ♦