wireshark didn't follow the timezone of my system

answered 2022-12-13 09:40:54 +0000

Wireshark looks for the TZ environment variable to use as a timezone, this will overrule the system setting. Do you by any chance have a TZ variable on your system?

sake@MacAir13:~/_tmp$ tshark -ta -c 1 -r c.pcap 
    1 04:46:52.951583 117.149.20.209 → 124.239.228.16 TCP 68 61042 → 80 [SYN] Seq=0 Win=42340 Len=0 MSS=1460 SACK_PERM=1 WS=2048
sake@MacAir13:~/_tmp$ TZ=Europe/Dublin tshark -ta -c 1 -r c.pcap 
    1 03:46:52.951583 117.149.20.209 → 124.239.228.16 TCP 68 61042 → 80 [SYN] Seq=0 Win=42340 Len=0 MSS=1460 SACK_PERM=1 WS=2048
sake@MacAir13:~/_tmp$ TZ=Europe/Athens tshark -ta -c 1 -r c.pcap 
    1 05:46:52.951583 117.149.20.209 → 124.239.228.16 TCP 68 61042 → 80 [SYN] Seq=0 Win=42340 Len=0 MSS=1460 SACK_PERM=1 WS=2048
sake@MacAir13:~/_tmp$

edit flag offensive delete link

Comments

Also: if the TZ is set to a value that is not understood or invalid, the system will treat this as it was set to UTC.

André ( 2022-12-13 21:40:06 +0000 )edit

TIL!

Hmmm... I would expected it to default back to the timezone from the system settings. Good to know, thanks!

SYN-bit ( 2022-12-14 14:04:11 +0000 )edit

6@18:48:22#xiakai1@tp/download> /cygdrive/d/program/wireshark/tshark -ta -c1 -r 21478.pcap 1 10:13:10.592133 10.21.239.12 → 10.21.239.12 TCP 68 21478 → 800 [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM WS=2048 6@18:48:36#xiakai1@tp/download> TZ=ASIA/Shanghai /cygdrive/d/program/wireshark/tshark -ta -c1 -r 21478.pcap 1 10:13:10.592133 10.21.239.12 → 10.21.239.12 TCP 68 21478 → 800 [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM WS=2048 6@18:48:57#xiakai1@tp/download> TZ=Europe/Dublin /cygdrive/d/program/wireshark/tshark -ta -c1 -r 21478.pcap 1 10:13:10.592133 10.21.239.12 → 10.21.239.12 TCP 68 21478 → 800 [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM WS=2048 6@18:49:19#xiakai1@tp ...(more)

walkerxk ( 2023-04-23 10:50:43 +0000 )edit

add a comment

How about just a screenshot, rather than a movie, so we don't have to pause the movie to see what's happening?

Guy Harris ( 2022-12-13 22:55:53 +0000 )edit

image description

TZ is Asia/Shanghai

timestamp is 1671250750 time should be 2022-12-17 12:19:10 not 2022-12-17 04:19:10

walkerxk ( 2022-12-17 04:39:21 +0000 )edit

wireshark didn't follow the timezone of my system

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

wireshark didn't follow the timezone of my system edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

wireshark didn't follow the timezone of my system