This is our old Q&A Site. Please post any new questions and answers at

Can someone help me to change UTC -3 times from my wireshark?

asked 26 Jun '17, 17:23

JorgeMiguelr210's gravatar image

accept rate: 0%

So is that "change the time stamps for the packets in the file" or is that "change the time stamps in the names of capture files"? From "I want my pcap file save the logs with the date and time of my local machine", it sounds as if you mean the time stamps in the file name rather than in the packets.

(26 Jun '17, 18:40) Guy Harris ♦♦

Change the time stamps for the packets in the file

(27 Jun '17, 05:56) JorgeMiguelr210

If you want to change timestamps in a capture file have a look at the -t option of the editcap command line tool.

permanent link

answered 27 Jun '17, 06:36

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Time stamps in pcap and pcapng files are stored as UTC (seconds and fractions of a second since January 1, 1970, 00:00:00 UTC, although leap seconds are usually not counted). Programs that read those files call routines to convert that to local time.

So if your machine isn't in the UTC-3 time zone, but you want to display the time stamps as UTC-3, you'd have to either shift the time stamps by the difference between UTC-3 and the time zone your machine is set for (which means that somebody else reading the capture file would, by default, see the time stamps incorrectly if they're in a different time zone), as per Jaap's suggestion, or you'd have to change the time zone setting of your machine, or you'd have to change the time zone for the instance Wireshark that's reading the file.

On most UN*Xes, you can change the time zone for a particular program by running it from the command line and setting the TZ environment variable to the appropriate value, for example TZ=Europe/London wireshark {filename} if you want the time stamps to display as time in the UK.

permanent link

answered 27 Jun '17, 10:02

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Jun '17, 17:23

question was seen: 7,442 times

last updated: 27 Jun '17, 10:02

p​o​w​e​r​e​d by O​S​Q​A