This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all,

I have been running tshark on a clean ubuntu server for a few weeks, but i've noticed something odd in the timestamps of each logfile, while i setup the duration to be each hour..

for example:

Nov 19 04:05 example1.cap

Nov 19 05:05 example2.cap

Nov 19 06:05 example3.cap

Nov 19 08:59 example4.cap

Nov 19 09:59 example5.cap

As can be seen there´s a time gap between example3.cap and example4.cap

This is the command i've been using: nohup tshark -i eth0 -t ad -w /var/log/filename.cap -b duration:3600 &

I´m worrying about this since there are specific random network problems appearing, because they might happen in these gaps..

Does anyone have an explanation for this, and what i should be doing=

asked 19 Nov '12, 02:20

ChrsL's gravatar image

ChrsL
0111
accept rate: 0%


That's where editcap can help.

editcap -t 300 input.cap output.cap

This will adjust the timestamp for +300 seconds. See the man page for editcap.

http://www.wireshark.org/docs/man-pages/editcap.html

You can do the same in Wireshark itself (please use the latest version).

Open the capture file and then:

Edit -> Time Shift

Regards
Kurt

permanent link

answered 19 Nov '12, 03:05

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thanks for the answer!

(07 Dec '12, 07:27) ChrsL

you're welcome.

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(07 Dec '12, 07:44) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×62
×12
×11

question asked: 19 Nov '12, 02:20

question was seen: 2,136 times

last updated: 07 Dec '12, 07:44

p​o​w​e​r​e​d by O​S​Q​A