Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Is it possible to replace a PCAP's timestamps with the timestamps in an ERSPAN header?

ERSPAN Type III headers contain hardware timestamps of when the packet actually traversed the capture device.

Wireshark correctly displays this timestamps, but is it possible to "rewrite" the PCAP timestamps with the ERSPAN timestamps?

We care far more about when a packet transited the ERSPAN source device than when it arrived at the packet capture endpoint.