Wireshark · Wireshark-users: Re: [Wireshark-users] frame.delta_time display filter question

[Sake Blok <sake@xxxxxxxxxx>]

On Tue, May 15, 2007 at 09:11:13AM -0400, andre.noel@xxxxxxx wrote:
> 
> I'm using Wireshark 0.99.5  and I wanted to isolate any frame which the delta from the previous is more
> 
> than 5 seconds so I used this display filter:  frame.time_delta > 5   but it doesn't look to work I got
> 
> erroneous results.  Can it be caused by the fact of the calculation is from the display and as the display refreshes 
> 
> during the filter parsing ?

Yes, you are correct, the filter "frame.time_delta > 5" will display all
frames that have a timestamp more than 5 seconds later than the 
previously *displayed* frame and not since the previously *captured* frame.

> Anyone already used it ?  If it was working it has been a really powerfull and fast way to isolate or find where delays are.

Actually this was solved in a recent bugfix. If you download a recent
buildbot build of Wireshark, you have two following fields:

- frame.time_delta -> time_delta since previous *captured* frame
- frame.time_delta_displayed -> time_delta since previous *displayed* frame

You can also select the two variants as columns.

Hope this helps,  Cheers,


Sake