Re: local timestamp recovery of .cap files

[Andrej van der Zee <andrejvanderzee () gmail com>]

Hi,

>        2) does, but "helpfully" converts the time to local time (in which
> case, whoever decided to be "helpful" needs to be hit with said sock).

I found that tcpdump with -tttt converts to local time, but tcpdump
-tt report GMT.

> However, even with standard pcap files, which have GMT time stamps, one
> might want to be able to display the time stamps in the time zone in which
> the capture was done rather than in the time zone in which it's being read;
> that's what the original poster wanted.

Exactly.

> Storing time zone information in
> the file, rather than getting it out of band (e.g., asking whoever sent you
> the file where they captured it) isn't a requirement, but it could be a
> convenience.

Would be convenient indeed.

Cheers,
Andrej
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.