Wireshark · Wireshark-users: Re: [Wireshark-users] Specifying a date range in editcap

["Jeroen Eeuwes" <jeroeneeuwes@xxxxxxxxx>]

Hi Andrew,

> No luck. Same result.

>From another message I gathered you use Microsoft Windows; I tried
under Linux (but not careful enough).

Anyway, the syntax with quotes works both under Linux and under
Microsoft Windows. At least with my "Editcap 0.99.7 (SVN Rev 23910)"
and XP Pro SP2.

Howver you should not use the -r parameter as this one does not work
with -A and -B. You'll get empty files back. So if you want to exclude
a time range you have to create two files and then merge them back
together.

E.g. this works on both my home computer (Linux) and work computer
(Microsoft Windows):

editcap -A "2007-11-05 17:00:00" -B "2007-11-05 18:00:00" in.pcap out.pcap

Best regards,
Jeroen