This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Changing log times using tshark

0

Hi all,

I have been running tshark on a clean ubuntu server for a few weeks, but i've noticed something odd in the timestamps of each logfile, while i setup the duration to be each hour..

for example:

Nov 19 04:05 example1.cap

Nov 19 05:05 example2.cap

Nov 19 06:05 example3.cap

Nov 19 08:59 example4.cap

Nov 19 09:59 example5.cap

As can be seen there´s a time gap between example3.cap and example4.cap

This is the command i've been using: nohup tshark -i eth0 -t ad -w /var/log/filename.cap -b duration:3600 &

I´m worrying about this since there are specific random network problems appearing, because they might happen in these gaps..

Does anyone have an explanation for this, and what i should be doing=

asked 19 Nov '12, 02:20

ChrsL's gravatar image

ChrsL
0111
accept rate: 0%


One Answer:

0

That's where editcap can help.

editcap -t 300 input.cap output.cap

This will adjust the timestamp for +300 seconds. See the man page for editcap.

http://www.wireshark.org/docs/man-pages/editcap.html

You can do the same in Wireshark itself (please use the latest version).

Open the capture file and then:

Edit -> Time Shift

Regards
Kurt

answered 19 Nov '12, 03:05

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thanks for the answer!

(07 Dec '12, 07:27) ChrsL

you're welcome.

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(07 Dec '12, 07:44) Kurt Knochner ♦