Revision history  [back]

An example of a command to use to calculate http.time with TShark is

tshark -r test.pcap -T fields -e http.time > test.pcap.tshark.txt

:-)

(It's calculated by the HTTP dissector in libwireshark, which is used both by Wireshark and TShark to dissect packets.)