Wireshark-users: [Wireshark-users] Question about frame.time_delta_displayed filter

From: Frank Pall <fpall77@xxxxxxxxx>
Date: Thu, 5 Feb 2009 03:27:35 -0800 (PST)

Hello, i am analyzing a huge amount of packets,and i am interested in the usage of the frame.time_delta_displayed filter,but i am honestly not understanding what's happening... I generate a UDP packet every 10ms,and i want to see if there are packets whose delta time exceeds a certain amount of time. I attach a sample capture file,exaplining the steps i'm doing: 1)i start with a total of 313 captured packets 2)i set the first sample as time reference 3)i order the displayed packets by the deltatime:i can see a maximum delta time of 0.017989 and all other packets' delta time is less than 0.014 4)i set a filter equal to frame.time_delta_displayed>0.014 expecting to see a single packet 5)instead,i see about half of the total number of packets,with different delta times from the original ones (i.e.,packet number 54:without any filter,the delta time is 0.010407; with the filter on,it becomes 0.021125) Wireshark version in 1.0.5 (SVN Rev 26954) Probably i misunderstood the usage of the filter...Can you please explain me why this happens? Thanks in advance! PS:Just an additional off-topic question:is there some tool capable of building chart on captured packets?

Attachment: all.pcap
Description: Binary data