This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark Change time UTC

0

Can someone help me to change UTC -3 times from my wireshark?

asked 26 Jun '17, 17:23

JorgeMiguelr210's gravatar image

JorgeMiguelr210
6446
accept rate: 0%

So is that "change the time stamps for the packets in the file" or is that "change the time stamps in the names of capture files"? From "I want my pcap file save the logs with the date and time of my local machine", it sounds as if you mean the time stamps in the file name rather than in the packets.

(26 Jun '17, 18:40) Guy Harris ♦♦

Change the time stamps for the packets in the file

(27 Jun '17, 05:56) JorgeMiguelr210

2 Answers:

0

If you want to change timestamps in a capture file have a look at the -t option of the editcap command line tool.

answered 27 Jun '17, 06:36

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

0

Time stamps in pcap and pcapng files are stored as UTC (seconds and fractions of a second since January 1, 1970, 00:00:00 UTC, although leap seconds are usually not counted). Programs that read those files call routines to convert that to local time.

So if your machine isn't in the UTC-3 time zone, but you want to display the time stamps as UTC-3, you'd have to either shift the time stamps by the difference between UTC-3 and the time zone your machine is set for (which means that somebody else reading the capture file would, by default, see the time stamps incorrectly if they're in a different time zone), as per Jaap's suggestion, or you'd have to change the time zone setting of your machine, or you'd have to change the time zone for the instance Wireshark that's reading the file.

On most UN*Xes, you can change the time zone for a particular program by running it from the command line and setting the TZ environment variable to the appropriate value, for example TZ=Europe/London wireshark {filename} if you want the time stamps to display as time in the UK.

answered 27 Jun '17, 10:02

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%