Wireshark mailing list archives
[Bug 6086] How does it work?
From: mmann78 () netscape net
Date: Tue, 2 Aug 2011 09:50:42 -0400 (EDT)
I was greatly intrigued by the patch from bug 6086 and my expectation was that 1. It would work on all protocols that had a FT_ABSOLUTE_TIME item (satisfying most of bug 1381) 2. Missing date/time fields in the filter would be set to 0 and considered "don't care" (ie "frame.time == 2011-08-02" would filter all frames received on Aug 2, 2011, regardless of hour/minute/second values) However I'm having a hard time creating a good "filter time string" for frame.time to be able to test it for time fields in other protocols (right now I was looking at NTP). The only time I can get this to work is if I specify the time string exactly down the "fractions of a second" field (hopefully I have that name right), and that obviously only gives me 1 packet. I'm using rev 38310, but I'm loading the sample NTP capture from the wiki (didn't think an "old" capture would matter for this) What am I missing? Mike
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- [Bug 6086] How does it work? mmann78 (Aug 02)
- Re: [Bug 6086] How does it work? Dirk Jagdmann (Aug 02)