 | 1 | initial version |
The default setting for Wireshark's Time column is "Seconds Since Beginning of Capture," and with that setting, the first packet is always going to be zero, regardless of what time of day it was captured.
You can see the actual time of day in the Frame section. If you want to also see the time of day in the Time column, go to View > Time Display Format and select one of the choices that displays the time of day.
Don't use the Time Shift function for this. The Time Shift function will change the actual arrival time of the packet. You don't want to change the recorded arrival time, you want to just change how the time is _displayed_.
"Seconds Since Beginning of Capture" is useful if you want to apply Time References in order to see elapsed times, so you could also leave the Time column setting at the default and add a second custom time column to show the time of day.
