ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Bug 1029 - Tshark -R doesn't support "frame.time >= Jul 20

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 14 Sep 2010 09:03:34 -0400
Steve Evans wrote:
I've been following the thread here:

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1029

...and I'm now running into the same problem. My syntax is as follows:

tshark -r 07_test.pcap -R 'frame.time >= "Aug  1, 2010 17:39:32.553872000"'

...However, its not being accepted ("parameter is not correct").

Does this bug still exist? Am I missing a quote somewhere?

I cut-n-paste that command into my shell, substituted one of my own file names, and it ran fine. I tried trunk (1.5), 1.4.0, and 1.2.10, all on 64-bit Linux.

What version and OS are you running?  What's your locale/language setting?