How can I change the time to match reality?

edit

The default setting for Wireshark's Time column is "Seconds Since Beginning of Capture," and with that setting, the first packet is always going to be zero, regardless of what time of day it was captured.

You can see the actual time of day in the Frame section. If you want to also see the time of day in the Time column, go to View > Time Display Format and select one of the choices that displays the time of day.

Don't use the Time Shift function for this. The Time Shift function will change the actual arrival time of the packet. You don't want to change the recorded arrival time, you want to just change how the time is _displayed_.

"Seconds Since Beginning of Capture" is useful if you want to apply Time References in order to see elapsed times, so you could also leave the Time column setting at the default and add a second custom time column to show the time of day.

Hi Glenn,

Time Shift allows you to "shift" the timestamp on captured packets.

This is helpful when looking at capture files across time zones. (This is one example.)

You look at a capture (PCAP) done in UTC 0 but you are in UTC +5.

Time shift allows you to shift all timestamps by five hours so that you are looking at timestamps for your time zone.

Did you look at Time Display Format?

Go to View -> Time Display Format

It's possible you are seeing the time column as "Seconds Since Beginning of Capture" (CTRL+ALT+4)

If that is the case try to use "Date and Time of Day" (CTRL+ALT+1) or simply "Time of Day" (CTRL+ALT+2)

Hope this helps.

Cheers,

JFD