Is there a way to write a display filter based on frame.time that ignores fractions of a second? I can make the frame list change precision, but the display filter still misses the frames I want to see because of the fractions in the data stream.
You could try using absolute time instead? Then you can use a filter such as:
frame.time >= "2019-07-24 11:00:00" and frame.time < "2019-07-24 12:00:00"
An easy way to do this is to first add an Absolute date, as YYYY-MM-DD, and time column under Edit -> Preferences -> Columns, and then you can just right-click on the time column contents of a frame that you're interested in and choose "Prepare a filter -> Selected".
After this, you'll then need to add quotes to the data (because there's apparently a Wireshark bug here that causes the data not to be quoted), remove the sub-seconds and adjust the comparison operator as needed. Copy/Paste/Tweak as necessary for the next range, or repeat with the last frame in the time range you're interested in.
Perfect! Using a range removes the need to ignore the precision. Great job! Thanks for the assist.
Comments