Wireshark display filter

[SpaceHonkey]

How can I filter packets between two points in time? I'm testing nmap bandwidth usage and want to analyse during the times that it is bursting...

 

[ben chi(f4)]

you can filter IP

ip.addr eq x.x.x.x

 

[SpaceHonkey]

I set a capture filter of host <IP> to do that. The problem is that, the full scan could take 9 seconds, but most (99%) of the communication is during second 2.5-3. In the summary, it calculates the the bandwidth based on the total or displayed packets. While the average over nine seconds is .081 Mbps, during that short 1/2 second burst it is much higher.

 

[SpaceHonkey]

Found something that works - filtering by frame number:

frame.number >= 4 && frame.number <= 3449

Actual thoughput is 10.644 Mbps. For 0.152798 seconds.

 

[Rurik]

It has to be a static date and time, otherwise you'd want to use frame.number (like you have there).

Otherwise:
frame.time > "Apr 9, 2009 14:03:42" and frame.time < "Apr 9, 2009 14:03:45"
frame.time > "Apr 9, 2009 14:03:42.5" and frame.time < "Apr 9, 2009 14:03:45.25"

 

[SpaceHonkey]

Ah - there's the time. I started looking under TIME (which is actually NTP), not frame.time.

I didn't even notice frame.time when I found frame.number - lol

Thanks all!

 

[Rurik]

There is no packet field for dates and times, the capture device instills that upon capture, so it goes into the overall frame metadata.

 

[vjg]

I know it's an old thread, but I found it looking for the search term "Wireshark filter by time frame" and others will too.

I found the best filter to use when filtering by time ranges is the relative time which is displayed on the capture display and is the time I'd expect to be able to use for filtering.

Use "frame.time_relative" as the filter expression term.

 

[SpaceHonkey]

Very nice - I didn't even remember posting this old thread

 

[joshenders]

I know it's an old thread, but I found it looking for the search term "Wireshark filter by time frame" and others will too.

I found the best filter to use when filtering by time ranges is the relative time which is displayed on the capture display and is the time I'd expect to be able to use for filtering.

Use "frame.time_relative" as the filter expression term.

Thanks for the follow up. Google lead me here and this was very helpful.