Wireshark-users: Re: [Wireshark-users] Display Filter "tcp.pdu.time"

From: j.snelders@xxxxxxxxxx
Date: Fri, 8 May 2009 07:26:50 +0200

Hi Kevin,

Hope this helps:
www.snia.org/events/storage-developer2008/presentations/monday/RonnieSahlberg_UsingWireshark.pdf

Regards
Joan

On Thu, 7 May 2009 15:30:35 -0500 Kevin Gaudineer wrote:

>Not sure where I am going wrong with my trace analysis but I have several
>SMB traces and there is a lot of TCP Segment of a Reassembled PDU frames
>in this trace.  I keep trying to use the display filter 'tcp.pdu.time' but
>nothing is ever displayed after typing the filter in?  The WireShark display
>filter help page says that the field will not be added into the TCP protocol
>tree until the first refresh.  After refreshing I still have nothing in
my
>display.  I am curious if I don't have the correct understanding of using
>this display filter.  Or do I need to do another step first before trying
>to use it?  Any help would be appreciated.