Wireshark-users: Re: [Wireshark-users] display filter

From: Abhijit Bare <abhibare@xxxxxxxxx>
Date: Tue, 1 Sep 2009 13:41:19 -0600

You can try a couple of methods:

1. Use editcap "-A" and "-B" option to create a new file with packets only between the two timestamps. Then, open the new file in wireshark.

2. You can use wireshark filter something like this:

frame.time > "Aug 20, 2008 01:34:13.000" and frame.time < "Aug 20, 2008 01:34:24.000"

Adjust the times according to what you want.

You can also filter on time relative to first frame using "frame.time_relative" if that is easier. Lookup "wireshark-filter" manpage.

Hope this helps,
- Abhijit