-1
  1. I run tcpdump on a remote host.
  2. I copy the dump to my linux workstation.
  3. I look at it with wireshark

The customer tells: Please look at the traffic at 8 o'clock.

... I found no way to filter the traffic to a time range.

I think I am missing something.

guettli
  • 25,042
  • 81
  • 346
  • 663

2 Answers2

1

to view the time of the capture, go to "View" -> "Time display format" and choose "Date and time of day"

mmm
  • 1,070
  • 1
  • 7
  • 15
1

You can use a display filter to filter on time range.
For example:
(frame.time >= "Mar 18, 2015 20:38:04.705104000") && (frame.time <= "Mar 18, 2015 20:38:06.415883000")

Useful link:
WiresharK Wiki

  • 1
    Thank you very much! ISO date formats are supported, too: `frame.time > "2015-09-03 20:38:04"` – guettli Sep 03 '15 at 12:28