Wireshark · Wireshark-users: Re: [Wireshark-users] Specifying a date range in editcap

["Jeroen Eeuwes" <jeroeneeuwes@xxxxxxxxx>]

Hi Andrew,

> editcap: "2007-12-06" isn't a valid time format

The parameter for the -A file is split up due to the space between the
date and time. You should try putting quotes around the date-time.
Eg.:

editcap -r -A "2007-12-06 15:00:00" -B "2007-12-06 16:00:00"
Infile.cap Outfile.cap

or remove the space:

editcap -r -A 2007-12-0615:00:00 -B 2007-12-0616:00:00 Infile.cap Outfile.cap

Best regards,
Jeroen