Re: Time Zone effect in Timestamps of Pcap

[Dale McCoy <dalestan () gmail com>]

On Sun, Oct 30, 2011 at 10:53, NITIN GOYAL <nitinkumgoyal () gmail com> wrote:
> Hi
> I have a very basic question. I capture a pcap with wireshark in some X
> timezone. Now, I send that pcap to some other time zone and now i see
> the timestamps changed as per the new time zone.
> Now, when i create pdml at both timezone they different in the timestamps.
> Is ther any way i wireshark where i can see the original timestamps and they
> wont change even if i send the pcap to any time zone.

Yes and no.

Unless I miss my guess, the pcap has timestamps stored in UTC. You can
set Wireshark to display UTC timestamps, regardless of the local
timezone, but I'm not aware of any way to force Wireshark to display
any particular (other, i.e. non-zero) timezone offset.

Dale McCoy
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe