Get first and last times from pcap file with Wireshark command line tools (like tshark)
<p>I have a huge collection of PCAP files, some of which have been "touched" since they were captured. This means the system timestamp on the file may not equate to the time of the data capture. Additionally, most of the files are autosaves from Wireshark, and sometimes the host computer doesn't get the data from the tap until after the capture time, so if this occurs just after a file autosaved, the next sequential file actually has captures prior to the end time of the previous file.</p>

<p>I have an automatic parser which uses tshark to go through these files. However, it takes about 2 minutes per file to run and I have tens of thousands of files, and I won't know that there's a timestamp issue until after it's run through the problem files.</p>

<p>Is there an easy way to grab the first "epoch time" and the last "epoch time" from a PCAP file using tshark (or another command line tool) without having to scan the entire file?</p>