This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Do you have an example of a text file for importing that has timestamps in the text file? I have tried the following with the %S format for Date/Time but the timestamp for all frames is displayed as 0.000000 in WireShark.

 0.000200
 0000 e0 9f 97 1c
 0004 20 5c 66 ae
 0008 19 d1 a6 80
 000c 08 00 45 00
 0010 00 99 00 00
 0014 40 00 ff 06
 0018 a8 7f 85 2d
 001c f7 e1 b5 d6
 0020 9f f9 01 da
 0024 01 da 00 00
 0028 00 00 00 00
 002c 00 00 50 18
 0030 ff ff 27 e2
 0034 00 00 55 5c
 0038 03 96 8f 9a
 003c a1 f8 73 69
 0.000400 
 0000 66 ae 19 d1
 0004 a6 80 e0 9f
 0008 97 1c 20 5c
 000c 08 00 45 00
 0010 00 a9 00 00
 0014 40 00 ff 06
 0018 a8 6f b5 d6
 001c 9f f9 85 2d
 0020 f7 e1 01 da
 0024 01 da 00 00
 0028 00 00 00 00
 002c 00 00 50 18
 0030 ff ff d0 67
 0034 00 00 58 32
 0038 bc 86 e9 cb
 003c 82 2f 0d 57
 0.000600 
 0000 e0 9f 97 1c
 0004 20 5c 66 ae
 0008 19 d1 a6 80
 000c 08 00 45 00
 0010 00 ab 00 00
 0014 40 00 ff 06
 0018 a8 6d 85 2d
 001c f7 e1 b5 d6
 0020 9f f9 01 da
 0024 01 da 00 00
 0028 00 71 00 00
 002c 00 00 50 18
 0030 ff ff f8 08
 0034 00 00 9c b0
 0038 16 e9 06 24
 003c c5 fa f1 e7

asked 15 Sep '11, 08:40

kevinj's gravatar image

kevinj
1111
accept rate: 0%

edited 15 Sep '11, 14:56

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245


You can add date and time (but I don't know how to add microseconds).

Copy and save this as dump

2011-09-01 00:00:02
0000 e0 9f 97 1c 20 5c 66 ae 19 d1 a6 80 08 00 45 00 
0010 00 99 00 00 40 00 ff 06 a8 7f 85 2d f7 e1 b5 d6 
0020 9f f9 01 da 01 da 00 00 00 00 00 00 00 00 50 18 
0030 ff ff 27 e2 00 00 55 5c 03 96 8f 9a a1 f8 73 69 

2011-09-01 00:00:04 0000 66 ae 19 d1 a6 80 e0 9f 97 1c 20 5c 08 00 45 00 0010 00 a9 00 00 40 00 ff 06 a8 6f b5 d6 9f f9 85 2d 0020 f7 e1 01 da 01 da 00 00 00 00 00 00 00 00 50 18 0030 ff ff d0 67 00 00 58 32 bc 86 e9 cb 82 2f 0d 57

2011-09-01 00:00:06 0000 e0 9f 97 1c 20 5c 66 ae 19 d1 a6 80 08 00 45 00 0010 00 ab 00 00 40 00 ff 06 a8 6d 85 2d f7 e1 b5 d6 0020 9f f9 01 da 01 da 00 00 00 71 00 00 00 00 50 18 0030 ff ff f8 08 00 00 9c b0 16 e9 06 24 c5 fa f1 e7

Run:
$ text2pcap -t "%Y-%m-%d %H:%M:%S" dump dump.pcap
Input from: dump
Output to: dump.pcap
Wrote packet of 64 bytes at 0
Wrote packet of 64 bytes at 64
Wrote packet of 63 bytes at 128
Read 3 potential packets, wrote 3 packets

permanent link

answered 15 Sep '11, 12:06

joke's gravatar image

joke
1.3k4934
accept rate: 9%

1

Or go to Wireshark directly.

Menu File|Import, select file name, check Data/Time and enter format string "%F %T" (which is equivalent to %Y-%m-%d %H:%M:%S). Click Ok and your done.

(16 Sep '11, 00:49) Jaap ♦

Import time format is determent by strftime(3), see also man text2pcap and User's Guide.

Trick is to add a dot after the %S (or %T for that matter) specifier.

permanent link

answered 16 Sep '11, 00:56

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

If you mean using text2pcap to import text files with timestamp information, then this is not yet supported, although this was filed as bug 1636 several years ago.

permanent link

answered 15 Sep '11, 10:47

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142
accept rate: 20%

Based on the other answers, the bug you mentioned is no longer an issue (and should be closed).

(16 Sep '11, 05:50) bstn

The bug was filed because text2pcap does not properly handle/parse capture files exported to text with packet summary and/or details information included. As far as I'm aware, this is still the case.

(16 Sep '11, 07:06) cmaynard ♦♦

Ok. However, it's evident (from @joke's answer) that text2pcap does support importing text files with timestamp information.

(16 Sep '11, 07:17) bstn

@bstn: the bug concerned is about writing out packet info from Wireshark into a text file, and later trying to import that. The Wireshark output does not adhere to od -Ax -tx1 layout, for which text2pcap was made. The bug report should be an enhancement request.

(16 Sep '11, 07:36) Jaap ♦

In my view, it's not an enhancement request because I feel that Wireshark's own tools should be able to inter-operate with each other. If Wireshark is able to export a pcap file to text, then Wireshark's text2pcap tool ought to be able to convert it back to exactly the same pcap file as the original. But if you feel strongly that it should be an enhancement, then feel free to change it.

(16 Sep '11, 07:45) cmaynard ♦♦

Enhancement or bug depends on the design goals. The manual page clearly states that text2pcap is intended to eat up octal dumps and spit out packet captures. It has some fancy stuff, like email comment marker digestion, #text2pcap inline directives and such. If it wouldn't do all this that would be a bug.

If we think the tool should be able to do more/something else then there's a addition/change in design goals. That's an enhancement.

Personally I don't care what this is called either way. As long as the tool does what people need it to do.

(17 Sep '11, 02:58) Jaap ♦

For what it's worth, I have reclassified bug 1636 as an enhancement.

(23 Sep '11, 13:34) cmaynard ♦♦
showing 5 of 7 show 2 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×62
×31
×15

question asked: 15 Sep '11, 08:40

question was seen: 7,491 times

last updated: 23 Sep '11, 13:34

p​o​w​e​r​e​d by O​S​Q​A