Editcap can take a capture file and re-write it based on a number of
command line options. I think the option for only writing certain
packet numbers is -r, something like
editcap -r myold.cap mynew.cap 1-1000 (substitute your numbers here).
This isn't so much filtering as it is creating a new file. Editcap can
also do conversions between capture formats. I don't believe it
supports an option to do this based on timestamps though.
On Tue, 2003-06-17 at 14:34, Ben Irving wrote:
> Hi,
> Is anyone aware of a very detailed document on ethereal filtering.
> The user guide does not cover what I am hoping to do. I would like to
> pull out a number of frames based on frame number, (i.e) frames 1 to
> 100000 or frames x to y. It would also be nice to be able to do this
> based on time. Thanks.
>
> -Ben
>
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
--
------------
James V. Fields