Hi Andrew, > No luck. Same result.
From another message I gathered you use Microsoft Windows; I tried under Linux (but not careful enough). Anyway, the syntax with quotes works both under Linux and under Microsoft Windows. At least with my "Editcap 0.99.7 (SVN Rev 23910)" and XP Pro SP2. Howver you should not use the -r parameter as this one does not work with -A and -B. You'll get empty files back. So if you want to exclude a time range you have to create two files and then merge them back together. E.g. this works on both my home computer (Linux) and work computer (Microsoft Windows): editcap -A "2007-11-05 17:00:00" -B "2007-11-05 18:00:00" in.pcap out.pcap Best regards, Jeroen _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
