Hi Kevin,
Hope this helps:
www.snia.org/events/storage-developer2008/presentations/monday/RonnieSahlberg_UsingWireshark.pdf
Regards
Joan
On Thu, 7 May 2009 15:30:35 -0500 Kevin Gaudineer wrote:
>Not sure where I am going wrong with my trace analysis but I have several
>SMB traces and there is a lot of TCP Segment of a Reassembled PDU frames
>in this trace. I keep trying to use the display filter 'tcp.pdu.time' but
>nothing is ever displayed after typing the filter in? The WireShark display
>filter help page says that the field will not be added into the TCP protocol
>tree until the first refresh. After refreshing I still have nothing in
my
>display. I am curious if I don't have the correct understanding of using
>this display filter. Or do I need to do another step first before trying
>to use it? Any help would be appreciated.