Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] editcap broken?

From: Jingshao Chen <jingshao@xxxxxxxxxx>
Date: Wed, 12 Dec 2007 09:03:06 -0800
Hi,

I am trying to change the timestamp of the packets in a pcap file with editcap. But it does not work. Is it broken or I used it wrong?

wireshark> editcap -t +100 test.pcap out.pcap 4635-4636
Add_Selected: 4635-4636
Inclusive ... 4635, 4636
wireshark>

After this, when I open out.pcap, the packets #4635 and #4636 were removed from the pcap file and that is it.

Thanks,
Jingshao Chen