This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to decode Timeticks (Hundreds seconds) to readable date time

Hi All,

sorry if I'm disturbing for probably stupid question .

I'm looking for a way to decode directly from wireshark (I'm actually using release 1.8.2) the timeticks from the hundred seconds view, like:

(Wireshark running on top of Windows XD Professional):

Object Name: 1.3.6.1.2.1.1.3.0 (iso.3.6.1.2.1.1.3.0) Value (TimeTicks): 129528167

to a readable values (Solaris 10 Example):

bash-3.00$ /usr/sfw/bin/snmpget -v2c -c public 10.194.34.18 1.3.6.1.2.1.1.3.0

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1525917187) 176 days, 14:39:31.87

is there any action that I can do on Wireshark or on Windows.

Best Regards

Alessandro.

eaping circuit

asked 03 Sep '12, 01:54

Alessandro
1●1●1●1
accept rate: 0%

One Answer:

is there any action that I can do on Wireshark or on Windows.

Wireshark

You can extend the SNMP dissector to convert the time ticks
You can write a Lua SNMP Postdissector (link#1 / link#2) to convert the time ticks.

Windows

Use the builtin calculator to convert the time.

1525917187 / 8640000 = days (+remainder) = 176.6107855324074
0.6107855324074 * 24 = hours (+remainder) = 14.65885277777778
0.65885277777778 * 60 = minutes (+remainder) = 39.53116666666667
0.53116666666667 * 60 = seconds.milliseconds = 31.87

Use your preferred scritping language to automate that process

Regards
Kurt

answered 03 Sep '12, 03:54

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Hi Kurt,

thanx for the answer, I appreciate.

I would like to use your first option adding an SNMP Dissector , but I don't know the procedure how to do it .

could you help on this too ?

Best Regards

Alessandro.

(03 Sep '12, 05:02) Alessandro

you don't have to add a dissector, you just need to extend the existing SNMP dissector.

but I don't know the procedure how to do it.

O.K., you will need some programming skills and some C know how. Then read the developer guide and take a look at the SNMP dissector code.

http://www.wireshark.org/docs/wsdg_html_chunked/
http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-snmp.c

(03 Sep '12, 08:08) Kurt Knochner ♦