This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Unable to save after time shift

0

I'm trying to merge different pcap files. Meanwhile, I'm trying to synchronize them and let's say I want them all to start at the 2017-01-01 00:00:00. i.e. my zero should be this date. I successfully do that with time shift tool but when I save as and reopen the same window the time shift is reset to the time before. Thank you for the help

asked 27 Mar '17, 07:30

nimaaaa's gravatar image

nimaaaa
6112
accept rate: 0%


One Answer:

1

To have a permanent time shift use the tool editcap. The options -t and/or -S are for time shifting operations.

To merge pcap files use the mergecap utility.

answered 27 Mar '17, 12:49

Uli's gravatar image

Uli
9031515
accept rate: 29%