An easy way to create a display filter is to select a packet that contains the value you want to filter. Click View, Packet Details. Expand the details view and find the line that contains the value you want to filter. For example, in the question below, find the line that contains "102.142566". In this case, the line will be
Time since reference or first frame: 102.142566 seconds
Right-click on this line, and select Prepare a Filter, Selected. In this case, the display filter will say
frame.time_relative == 102.142566
Finally, edit the display filter to meet your need. In this case, edit to say
frame.time_relative < 200
Harvey S. Cohen
-----Original Message-----
Message: 1
Date: Wed, 19 Nov 2014 03:40:31 +0000 (UTC)
From: Rayne <hjazz6@xxxxxxxxx>
To: "wireshark-users@xxxxxxxxxxxxx" <wireshark-users@xxxxxxxxxxxxx>
Subject: [Wireshark-users] Filtering based on time column
Message-ID:
<1644948820.2368945.1416368431273.JavaMail.yahoo@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"
Hi,
Is there a way to filter for packets based on the time displayed in the Time column? For example, I have 5 packets that have the Time values "0.000000", "30.402577", "102.142566", "200.102244", "541.715466" and "612.841142". I want to filter for the first 3 packets, i.e. those with Time less than 200. How do I do that?
Thank you.
Regards,Rayne
