On Tue, 13 Dec 2005, Ed Flecko wrote:
> Hi folks,
> I see from the newsgroup that it's possible for me to filter the
> displayed packets within a time range by doing something like:
>
> frame.time >= "Aug 1, 2001 00:52:34" && frame.time <= "Aug 1, 2001 00:55:34"
>
> My question is: can I filter and then display the captured packets by
> using only a time range and not a date range? For example, I have a
> capture that spans several days but I want to only see the packets
> captured between 4:00-8:00 am. on all days of the capture. Is this
> possible? Is there a wildcard character that I can use in ethereal in
> place of the actual date. Or, in a worse case scenario, can I do
> something like:
>
> frame.time >= "Aug 1, 2001 00:52:34" && frame.time <= "Aug 1, 2001 00:55:34"
> && frame.time >= "Aug 1, 2001 00:57:34" && frame.time <= "Aug 1, 2001 00:59:34" ???
>
> I tried something very similar to this, and it didn't seem to work. It
> didn't produce an error message, it just didn't work.
>
> Suggestions???
>
> Thank you,
> Ed
Well, there seem to be no shortcut here. An absolute time is required,
thats including a date. So we get to your wurst kaze :)
Which should be:
(frame.time >= "Aug 1, 2001 00:52:34" && frame.time <= "Aug 1, 2001 00:55:34")
|| (frame.time >= "Aug 1, 2001 00:57:34" && frame.time <= "Aug 1, 2001 00:59:34")
Not the difference? You need to OR the two timespans.
Good luck,
Jaap