The first SYN packet contain timestamp zero
That's because you're looking at the "time since first frame" and "time since previous frame" values. Those are NOT the time stamp of the packet in the capture, those are:
- the difference between the time stamp in the capture for the packet you're looking at and the time stamp in the capture for the first packet in the TCP stream, as indicated by "Time since first frame in this TCP stream";
- the difference between the time stamp in the capture for the packet you're looking at and the time stamp in the capture for the previous packet in the TCP stream, if there is one, as indicated by "Time since previous frame in this TCP stream".
As this is the first SYN packet, it is the first packet in the TCP stream, so the first difference is guaranteed to be zero, and it has no previous packet, so the second difference is reported as zero.
I want timestamps value in UTC
Then what you want to do is:
- from the View" menu, select the "Time Display Format" submenu and, in that submenu, select "UTC Date and Time Of Day (1970-01-01 01:02:03.123456)";
- look at the "Arrival Time" entry under the "Frame N" item at the top of the packet detail display, rather than anything in the TCP information.
