Re: is there an easy way to get TZ from a dump file?

[Guy Harris <guy () alum mit edu>]

On Mar 15, 2004, at 11:20 AM, alex medvedev wrote:

> is there an easy way to get the timezone information from the libpcap 
> dump
> file?
> timezone info is in the pcap_t

No, it's not.  The field is there, but nothing sets it to a meaningful 
value - it's not set on live captures at all (so it's zero, as a pcap_t 
is zeroed out), and, when reading a savefile, it's set to the value 
from the savefile's header - but, when writing a capture, libpcap sets 
the value in the save file's header to the value from the pcap_t from 
which the packets are coming.

I.e., there's no code anywhere in libpcap that actually sets "tzoff" in 
the pcap_t structure, or "thiszone" in the capture file header, to any 
value based on the (current) offset from UTC/TAI/whatever.

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe