Tshark frame.time format
Hi.
I trying to get the output of the frame.time in a format like 2020-01-01 12:01:01, but I cannot seem to find out how to do that.
I am using a command like
tshark -r 0001.pcap -T fields -e frame.time -e ip.src -e ip.dst
Current result is
May 20, 2020 12:01:01.000000001 [ip] [ip]
but what I want is
2020-05-20 12:01:01.000000001 [ip] [ip]
How do I do that???
Comments
Is it similar to this question ?
Will
_ws.col.Time
work for you?Hi Folks, sorry to ask such a stupid question regarding this topic. I basically have the same topic as the threadstarter, but with a small difference. If i use the command "_ws.col.Time" on my linux system, no output is written in my .txt file. If i use frame.time, the output in the format frome above will be saved...
I also retried the same command line on my windows systems; there it works fine with "_ws.col.Time"...
Im totally confused why this behavior stucks on my Linux system (which is preferred to be used for decoding).
Best regards Julius
Are you using the same version (
tshark -v
) and same profile on both systems?(see 11.6. Configuration Profiles for Export/Import)
@Julius, please ask a separate question rather than piggy-backing on this one. Your question is not the same as the original question posed here and any answer will be different as well.