1.过滤端口为5001的tcp包，将时间输出
tshark -r h1.pcap -Y "tcp.port==5001" -T fields -e frame.time
时间格式如
“Jan 1,2016 20:27:30.355595000 CST”
2.调整时间格式
tshark -r h1.pcap -Y "tcp.port==5001" -o column.format:"packet,%m,Time,%t,Info,%i"
%t输出格式为 10.710926
%Yt输出格式为 2016-01-01 20:27:30.355595
wireshark - How do I format tshark time to ISO format (yyyy-dd-mm)? - Stack Overflow
tshark\ -\ The\ Wireshark\ Network\ Analyzer\ 2.0.0
原文：http://www.cnblogs.com/jiangz/p/5094307.html