Hi all,
The man-pages don't mention to use quotes.
http://www.wireshark.org/docs/man-pages/editcap.html
Editcap 1.0.99-SVN-25317 (SVN Rev 25317)
Packet selection:
-A <start time> don't output packets whose timestamp is before the
given time (format as YYYY-MM-DD hh:mm:ss)
-B <stop time> don't output packets whose timestamp is after the
given time (format as YYYY-MM-DD hh:mm:ss)
Grtz
Joan
>Hi Joan
>Many thanks
You're Welcome
>
>Did you use quotes?
>
>C:\>editcap -B 2008-05-02 12:03:00 C:\Test.cap C:\Test.cap
>editcap: "2008-05-02" isn't a valid time format
>
>C:\>editcap -B "2008-05-02 12:03:00" C:\Test.cap C:\Test.cap
>
>
>>-- Oorspronkelijk bericht --
>>Date: Fri, 23 May 2008 15:25:36 +0100
>>From: "Alhaisoni, Majed" <malhai@xxxxxxxxxxx>
>>To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
>>Subject: [Wireshark-users] Editing Wireshark File
>>Reply-To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
>>
>>
>>Hello Guys,
>>
>>I have captured data for one hour and I would like to devide them to 1
min
>>file and I tried editcap but I got problem with the date and time format.
>>Anyone can help with this plz.
>>
>>Kind regards,
