Question on Editcap with -t option

Question

I am running following command

editcap -t -0.2 http-disney101.pcapng duplicate.pcapng

I was informed that above command subtracts 0.2 seconds from http-disney101.pcapng and creates a new trace file duplicate.pcapng but in new trace file i am not seeing any packet with new time stamp getting triggered.Am i missing anything here?

Answer 1

0

Works well on my system (Win XP, Wwireshark 1.9.2). What is your version and OS?

Source File: icmp.pcap Modified File: icmp_mod.pcap

Original:

tshark -nr icmp.pcap -t ad

  1 2013-06-19 10:45:56.838904 192.168.158.139 -> 174.137.42.77 ICMP 74 0xd743
  2 2013-06-19 10:45:57.055699 174.137.42.77 -> 192.168.158.139 ICMP 74 0x76e1
  3 2013-06-19 10:45:57.840049 192.168.158.139 -> 174.137.42.77 ICMP 74 0xd746

Editcap:

editcap -t -0.2 icmp.pcap icmp_mod.pcap

Modified:

tshark -nr icmp_mod.pcap -t ad

  1 2013-06-19 10:45:56.638904000 192.168.158.139 -> 174.137.42.77 ICMP 74 0xd743
  2 2013-06-19 10:45:56.855699000 174.137.42.77 -> 192.168.158.139 ICMP 74 0x76e1
  3 2013-06-19 10:45:57.640049000 192.168.158.139 -> 174.137.42.77 ICMP 74 0xd746

Regards
Kurt

answered 19 Jun '13, 01:53

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 19 Jun '13, 02:53

Windows 7 Enterprise(wireshark 1.10.0(SVN Rev 49790 from /tunk-1.10)

(19 Jun '13, 15:27) krishnayeddula

Works also with 1.10.0, just tested. What happens if you repeat my steps above (with my sample file and with your sample file)?

(20 Jun '13, 00:01) Kurt Knochner ♦

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(16 Jul '13, 05:54) Kurt Knochner ♦

@Kurt: I can't help but notice that you seem to be on some kind of a mission... answering almost anything, gunning for points... whats up, on a vacation and bored? :-D

(16 Jul '13, 06:15) Jasper ♦♦

you seem to be on some kind of a mission. answering almost anything,

:-))

Well, my primary 'mission' is

to participate in the Q&A (question and answer) system here ;-) So, yes I do answer those questions I'm able to answer and that are kind of interesting for me.
learn something by answering questions
learn something by reading the answers of others

whats up, on a vacation and bored? :-D

well, no ;-)

But as you ask: Is anybody unhappy with my way of participation? If so, please tell me why.

Anyway my special mission in this case: @krishnayeddula asks questions, but for 50% he/she never closes those questions or does not react on updates. That's not good for a Q&A site and I decided to give him/her a 'small nudge' by updating some of his/her questions.

If he/she (or anybody else) feels annoyed by this, I'm sorry.

Cheers Kurt

(16 Jul '13, 07:14) Kurt Knochner ♦

No, don't get me wrong, I think it's great when there are good answers to as many questions as possible, and yours are usually extremely well researched :-)

It's just that whenever I open the page almost all questions have your name beneath them, and I can't recall it being this intense before - so I got a little curious. But there's no need to be sorry, just fire away - I don't care about the user list ranking anymore. Guy is going to get me eventually, too, and that's fine with me ;-)

And, I think this is a common thing for all of us: it seems nobody gets past 15% accept rate in the long run. Sad but true.

(16 Jul '13, 07:22) Jasper ♦♦

hmm the arrow came directly to me :).Sorry Kurt now on i will make it a point to follow up on my questions.Appreciate your time.Thanks again.

(16 Jul '13, 07:22) krishnayeddula

There are many more users you need to "nudge". There are currently 138 pages of "unanswered questions" of which many do have answers that haven't been accepted.

(16 Jul '13, 07:26) grahamb ♦

I don't care about the user list ranking anymore. Guy is going to get me eventually, too, and that's fine with me ;-)

I don't care about the user list ranking at all. I just 'enjoy' working with Wireshark and I'm glad to be able to share my humble knowledge and to extend it. In the past I learned the most about products and/or technologies while I was active in a forum and was 'forced' to think about the problems of other people.

And, I think this is a common thing for all of us: it seems nobody gets past 15% accept rate in the long run. Sad but true.

That's because almost all users on this site are one-time users. They register, ask a question and never come back. Only about 50 users are active on a regular base, which is a surprisingly low number for a tool like Wireshark. I don't understand this either, especially if you look at stackoverflow. Strange.

(16 Jul '13, 07:30) Kurt Knochner ♦

I guess it isn't well known, still. I advertise it where- and whenever I have the chance, but I guess most Wireshark users have never heard of it.

(16 Jul '13, 07:46) Jasper ♦♦

I guess it isn't well known, still.

maybe. I heard of it from you, roughly about one year ago.

Unfortunately it's also not mentioned on the entry page of http://www.wireshark.org either. On the other side, it's the first link under "Get help".

(16 Jul '13, 07:50) Kurt Knochner ♦

There are many more users you need to "nudge". There are currently 138 pages of "unanswered questions" of which many do have answers that haven't been accepted.

Well, you are right. However, I don't feel I'm in a position to update the answers of other people, unless there is an obvious error.

In the case of @krishnayeddula, I just took the chance because of his/her latest questions.

As far as I know, there is an option for the moderators/admins to accept an answer in the name of the user. That would help to "clean up" the site a bit. However, who is going to decide if an answer is what the OP expected to get.

(16 Jul '13, 07:58) Kurt Knochner ♦

For the record I'm entirely happy for Kurt to go through any questions that I've answered and that haven't been accepted and nudge the OP.

Edit: And for similar reasons I asked Gerald to added the canned comments about accepting answers and converting "answers" to comments.

(16 Jul '13, 08:04) grahamb ♦

O.K. I will do so in the future, at least occasionally, if I see such a question/answer ;-)

(16 Jul '13, 08:08) Kurt Knochner ♦

showing 5 of 14 show 9 more comments