On Tue, May 15, 2007 at 09:11:13AM -0400, andre.noel@xxxxxxx wrote:
>
> I'm using Wireshark 0.99.5 and I wanted to isolate any frame which the delta from the previous is more
>
> than 5 seconds so I used this display filter: frame.time_delta > 5 but it doesn't look to work I got
>
> erroneous results. Can it be caused by the fact of the calculation is from the display and as the display refreshes
>
> during the filter parsing ?
Yes, you are correct, the filter "frame.time_delta > 5" will display all
frames that have a timestamp more than 5 seconds later than the
previously *displayed* frame and not since the previously *captured* frame.
> Anyone already used it ? If it was working it has been a really powerfull and fast way to isolate or find where delays are.
Actually this was solved in a recent bugfix. If you download a recent
buildbot build of Wireshark, you have two following fields:
- frame.time_delta -> time_delta since previous *captured* frame
- frame.time_delta_displayed -> time_delta since previous *displayed* frame
You can also select the two variants as columns.
Hope this helps, Cheers,
Sake