Has anyone worked out how to save a pcap with shifted (interpolated/extrapolated) timestamps?

First time here? Check out the FAQ!

time
Shift
Timestamp

Time Shift in the Edit menu is great. But I can't save the modified pcap and I need to import it into another analysis tool. Editpcap is too simple - just allows a fixed offset in all timestamps.

add a comment

1 Answer

Sort by » oldest newest most voted

answered Feb 5 '0

Guy Harris
19905 ●3 ●667 ●207

See bug 14306. Note that there are times when times are shifted and it isn't appropriate to save the times; in those cases, what should be done is change the way UTC times are displayed as local times, rather than to shift the times in the file.

link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: Feb 5 '0

Seen: 765 times

Last updated: Feb 05 '20

Has anyone worked out how to save a pcap with shifted (interpolated/extrapolated) timestamps? savecancel

1 Answer