Can someone help me to change UTC -3 times from my wireshark? asked 26 Jun '17, 17:23  JorgeMiguelr210 |
2 Answers:
If you want to change timestamps in a capture file have a look at the answered 27 Jun '17, 06:36  Jaap ♦ |
Time stamps in pcap and pcapng files are stored as UTC (seconds and fractions of a second since January 1, 1970, 00:00:00 UTC, although leap seconds are usually not counted). Programs that read those files call routines to convert that to local time. So if your machine isn't in the UTC-3 time zone, but you want to display the time stamps as UTC-3, you'd have to either shift the time stamps by the difference between UTC-3 and the time zone your machine is set for (which means that somebody else reading the capture file would, by default, see the time stamps incorrectly if they're in a different time zone), as per Jaap's suggestion, or you'd have to change the time zone setting of your machine, or you'd have to change the time zone for the instance Wireshark that's reading the file. On most UN*Xes, you can change the time zone for a particular program by running it from the command line and setting the answered 27 Jun '17, 10:02  Guy Harris ♦♦ |
So is that "change the time stamps for the packets in the file" or is that "change the time stamps in the names of capture files"? From "I want my pcap file save the logs with the date and time of my local machine", it sounds as if you mean the time stamps in the file name rather than in the packets.
Change the time stamps for the packets in the file