Wireshark-users: Re: [Wireshark-users] Specifying a date range in editcap

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Jeroen Eeuwes" <jeroeneeuwes@xxxxxxxxx>
Date: Fri, 28 Dec 2007 11:00:43 +0100
Hi Andrew,

> No luck. Same result.

>From another message I gathered you use Microsoft Windows; I tried
under Linux (but not careful enough).

Anyway, the syntax with quotes works both under Linux and under
Microsoft Windows. At least with my "Editcap 0.99.7 (SVN Rev 23910)"
and XP Pro SP2.

Howver you should not use the -r parameter as this one does not work
with -A and -B. You'll get empty files back. So if you want to exclude
a time range you have to create two files and then merge them back
together.

E.g. this works on both my home computer (Linux) and work computer
(Microsoft Windows):

editcap -A "2007-11-05 17:00:00" -B "2007-11-05 18:00:00" in.pcap out.pcap

Best regards,
Jeroen