Wireshark · Ethereal-users: [Ethereal-users] custom display filters

["ali niaz" <alinaqvi90@xxxxxxxxxxx>]

Dear all

 

I am relatively new to Ethereal and want to build a display filter and needed some help.

 

All I want to do is to seperate the captured TCP packets(in a dump file) based on the difference of time received between 2 packets say 0.5s . So for e.g packet 1 is received at time 0s, packet2 at time 0.3s, packet 3 at 0.7s and packet 4 at 1.3s. Now the packets 1 to 3 will be put into batch1 and packet4 into batch2 because time difference between packet 4 and packet 3  is more than 0.5s.

 

Preferably each batch would be put into a seperate file.

 

 

I have looked into the display filters and although quite powerful do not provide me with full automation. I want every thing to be done based just on the time of arrival of each packet, human intervention.

 

Hope you understand my question

Thanx in advance

 

Regards

ali

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users