how do i access data from a specific date and time frame?

retag add tags

i'm trying to figure out how to look up the recorded information on wireshark from a particular date and time. the information i need is very important can anyone help with step by step instructions, guidance, anything? Please any help would be greatly appreciated

I like using the frame.time field for this.

You should see this field under Frame in the Packet details pane if your capture has Ethernet frames in it.

You can see packets for certain times using these filters:

Packets received ON or AFTER December 28, 2018 16:45:

frame.time >= "Dec 28, 2018 16:45:00.000000000"

Packets received BETWEEN 16:45 and 17:45 on December 28, 2018:

(frame.time >= "Dec 28, 2018 16:45:00.000000000" ) && (frame.time <= "Dec 28, 2018 17:45:00.000000000")

Hopefully you know what the time was on the capture device (precision, timezone, etc.) because that is the time used for that field.

Cheers,

JFD

191

Spooky

answered 2019-06-10 21:55:54 +0000

edit flag offensive 0 remove flag delete link

Comments

thank you so much. im not real computer savvy all the verbiage confuses me as its always changing or i don't remember how to do something i like to have a visual guide or instruction so i can refer back and this will help alot will definitely try this.. so very appreciated thanks again :)

jenna (2019-06-10 23:34:37 +0000) edit

Glad I could help!

Please mark the answer as correct (click the checkmark) so others may benefit from it in the future.

JFD

Spooky (2019-06-11 21:31:23 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

how do i access data from a specific date and time frame? edit

Comments

1 Answer

Comments