I have a cap file captured with tcpdump on a Linux system. The first paket is known to be dated When I run If I run tshark on Windows with So my question is: what is going on with my timestamps? Both machines I am using are in the same timezone and clocks are set correctly. Can I have tshark display the time I want without doing any conversions myself? EDIT: How to reproduce It is actually simple to reproduce. I simply captured a telnet attempt with tcpdump and ran capinfos on it. What really bothers me is tshark and wireshark not displaying the same thing. If I play with the timestamps with editcap, they won't show up correctly in wireshark anymore. If I capture with tshark I won't have such problem. Maybe its time to start capturing directly with tshark. I have been capturing with tcpdump out of habit (and analysing with wireshark on windows). RHEL 5.7 (tcpdump-3.9.4-15, wireshark-1.0.15-1) On Windows (Wireshark Version 1.8.4 (SVN Rev 46250 from /trunk-1.8, cygwin) EDIT 2 The timezone is identical on both systems. The simplest way to see it: On Linux TZ is not set. /etc/timezone does not exist on RHEL. But here’s what I have in /etc/sysconfig/clock: On Windows, TZ is not set. But the date gui shows the right zone as well as regedit: This whole problem seems to revolve around UTC. The dates I see in capinfos and tshark are UTC. asked 13 Dec ‘12, 12:31  PhilippeA edited 11 Mar ‘16, 16:01  Guy Harris ♦♦ |
2 Answers:
By default, Wireshark and associated programs follow the timezone setting of the user, and display times in the users local timezone. I would guess that the timezone setting for the command prompt on the windows systems where you are running the errant capinfos and tshark have a timezone that is set 5 hours earlier than the linux system. Edit: After your edit 2 about the timezone settings I'm a bit confused. On Windows are you running a Windows version or a Linux version run with Cygwin? If you are using a Windows version then try running it under a normal Windows Cmd Prompt or PowerShell rather than Cygwin. answered 14 Dec '12, 08:17  grahamb ♦ edited 17 Dec '12, 09:34 The date command output is from Cygwin. I checked the rest in cmd. The bottom line remains the same: my clocks and timezones are consistent. (17 Dec '12, 11:02) PhilippeA what happens if you run capinfos from outside of cygwin? (17 Dec '12, 11:06) Kurt Knochner ♦ Cygwin was the culprit. The TZ is set in cygwin. I don't understand why, but disabling it solves my issue. (17 Dec '12, 12:01) PhilippeA Good! Please accept the answer of @grahamb for the benefit of other users. (17 Dec '12, 12:07) Kurt Knochner ♦ |
it shows the same timestamp on my Ubuntu 12.04 and my Win XP system (see below), but a different time than on your system, which is due to a different time zone (here: CET). So I guess, it's a timezone problem, as already mentioned by @grahamb. What is the output of these commands on your systems?
Windows XP Ubuntu 12.04 Regards answered 17 Dec ‘12, 08:09  Kurt Knochner ♦ edited 17 Dec ‘12, 08:21 |
can you post that file somewhere (cloudshark.org)?
See http://cloudshark.org/captures/50cca25994ec. The timestamp in cloudshark shows correctly (10:17:44). But it should not with tshark/capinfos. Please also see my question edit. Thanks.
Did you look at my answer below? Can you show the output of
set TZfrom the command prompt where you call capinfos\tshark?Eastern Standard Time == GMT - 5, so it looks like your windows system shows GMT time (5 hours difference).