Wireshark-bugs: [Wireshark-bugs] [Bug 6141] "frame.time_delta_displayed" filter does not work co

Date: Tue, 19 Jul 2011 23:57:20 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6141

Sake <sake@xxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from Sake <sake@xxxxxxxxxx> 2011-07-19 23:57:19 PDT ---
(In reply to comment #0)
> "frame.time_delta_displayed" filter does not work at "==  >  >== ", except
> value 0; when use "<=", the result is not correct, and lost some packets which
> match the filter. You can try "frame.time_delta_displayed <= 3" fiter with the
> attachment.

As the value of frame.time_delta_diaplayed changes with which frames are
displayed, using it as a display filter will result in unexpected results.
There is no (good) way to fix this.

The good news is that you can use the filter "frame.time_delta > 3" for your
purpose, this filter will show all packets which were captured more than 3
seconds after the last captured packet.

Then there is also the filter "tcp.time_delta" (if you don't have it, enable
TCP timestamps in the TCP protocol preferences). With that filter you can
select packets with a large delta time in each TCP stream.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.