Milton,
Use:
frame.number < 20 and frame.number > 10
as your filter and you should be on your way.
You can do something similair as this with frame.time > .... and frame.time
< .... Where time is arrival time. For more filtering possibilities just
click on the filter button in the lower left corner of the window. Then
click 'add expression'. From the list that now appears, and you can choose
whatever you want to filter on, including the frame filter I've just
described.
Succes,
Marco.
----- Original Message -----
From: "Bliss, Milton" <Milton.Bliss@xxxxxxxxxxxxxxxxxxxxx>
To: <ethereal-users@xxxxxxxxxxxx>
Sent: Wednesday, August 13, 2003 6:51 AM
Subject: [Ethereal-users] Saving a portion of a capture
I want to save only the first 2000 packets of a capture, thereby my save
file will be small.
I thought I should create a display filter and save only the displayed
packets. The problem is, I cannot find the filter field corresponding to
a packet number. Then I thought I could filter on the time field but
when I select protocol time in the display filter, add expression
dialog, then select <, the error message tells me the field cannot be
tested with "<".
Which leaves me with what I'm sure is simple, dumb question:
How do I save only the first 2000 lines of a captured set of packets?
I have read about 4 hours today but have not found the answer.
Milton Bliss
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users
