[Wireshark-users] Time in .pcap file

2007-02-19 Thread Goran Štrok
I do not know how to get time from .pcap file. If open any pcap file with hex editor I think that first 24 B is a pcap header, then is 16 B where first 8 B is time. Is that true??? If that is true I do not know, how to understand and get time from this 8 B. I have tried several pcap files but I

Re: [Wireshark-users] Filtering Network address

2007-02-19 Thread Stephen Fisher
On Tue, Feb 20, 2007 at 08:20:43AM +0700, Muhammad Ghazali wrote: How can filter to capture only packet coming and going to 1.1.1.1? Using the display filter near the top of the Wireshark window, type in: ip.addr == 1.1.1.1 I want to measure the response time of a web application and the

Re: [Wireshark-users] Filtering Network address

2007-02-19 Thread Guy Harris
On Feb 19, 2007, at 5:20 PM, Muhammad Ghazali wrote: How can filter to capture only packet coming and going to 1.1.1.1? If you only want to capture traffic to or from 1.1.1.1, then, when capturing, use the capture filter host 1.1.1.1. If you already have captured traffic, not all of which

Re: [Wireshark-users] Time in .pcap file

2007-02-19 Thread Guy Harris
On Feb 19, 2007, at 6:16 AM, Goran Štrok wrote: Thanks a lot. This is what I need. If you're trying to read a pcap-format file, it's probably a lot easier if you use, well, *pcap* (libpcap on UN*X, WinPcap on Windows) - it already supports reading those files, and handles byte order,

Re: [Wireshark-users] Filtering Network address

2007-02-19 Thread Muhammad Ghazali
On 2/20/07, Stephen Fisher [EMAIL PROTECTED] wrote: On Tue, Feb 20, 2007 at 08:20:43AM +0700, Muhammad Ghazali wrote: How can filter to capture only packet coming and going to 1.1.1.1? Using the display filter near the top of the Wireshark window, type in: ip.addr == 1.1.1.1 Ok I tried

Re: [Wireshark-users] Filtering Network address

2007-02-19 Thread Muhammad Ghazali
On 2/20/07, Guy Harris [EMAIL PROTECTED] wrote: On Feb 19, 2007, at 6:46 PM, Muhammad Ghazali wrote: Can you tell me the trick how to measure the response time of the web application and the smtp response by manually looking at the packet? Web and SMTP? You said I want to

Re: [Wireshark-users] Filtering Network address

2007-02-19 Thread Muhammad Ghazali
On 2/20/07, Muhammad Ghazali [EMAIL PROTECTED] wrote: On 2/20/07, Guy Harris [EMAIL PROTECTED] wrote: On Feb 19, 2007, at 6:46 PM, Muhammad Ghazali wrote: Can you tell me the trick how to measure the response time of the web application and the smtp response by manually looking at the

Re: [Wireshark-users] Filtering Network address

2007-02-19 Thread Muhammad Ghazali
On 2/20/07, Muhammad Ghazali [EMAIL PROTECTED] wrote: In fact, I'd like to measure the response time of 3 different things. - The web applcation, - web based email where a web application cause email to be sent, - and smtp session where I will send (and receive) email from email client