Re: tcp.time_delta column with tshark

["j.snelders" <j.snelders () telfort nl>]

On Sat, 29 Jan 2011 17:24:21 +0100 Sake Blok wrote:
> On 29 jan 2011, at 16:52, j.snelders wrote:
>
> > On Sat, 29 Jan 2011 00:26:40 -0800 (PST) vincent paul wrote:
> > > 1) I try to use tshark to export a capture into csv file.  I use -T fields
> > > -E 
> > > separator=, -e tcp.time_delta.......  I could see other column data but
> > not
> > > tcp.time_delta .  Any idea.
> >
> > No, but it does print the frame.time_delta
> > $ tshark -r test.pcap -T fields -E separator=, -e frame.number -e frame.time_delta
>
> In order to be able to use tcp.time_relative and tcp.time_delta, you will
> need to enable TCP timestamps. This is disabled by default (for performance
> optimization).
>
> You can check whether tshark is using TCP timestamps:
>
> $ tshark -G currentprefs | grep tcp.calculate_timestamps
> tcp.calculate_timestamps: TRUE
> $
>
> If you want to enable them, use:
>
> tshark -o cp.calculate_timestamps:TRUE -r <file> -T fields -e ... -e tcp.time_delta
> -e ...
>
> Cheers,
>
>
> Sake

Dank je wel;-)
Joke


       


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe