How to convert pcap file to text file with correct timestamp using tshark ?

Question

What are the tshark options to be used to read/convert a pcap file to a text file, with its default one-line description, but with correct timestamps ?

It increments from 0.0 by default, but I want the exact unix time for each of the packets in the text file along with the default values.

I'm using the below command currently

tshark -i - < srcfile.cap > destfile.txt

Accepted Answer

What @Jasper said, or use the tshark CLI options, see tshark -h:

-t a|ad|d|dd|e|r|u|ud    output format of time stamps (def: r: rel. to first)

so, tshark -r srcfile.pcap -t ad > destfile.txt will do the trick.

Answer 2

Change the time column display format in the default preferences, e.g. by running Wireshark and using Edit -> Preferences -> User Interface -> Columns. Set "Time" value to "Absolute Date and Time" (or any other time format you like).

tshark uses the default profile by default (no pun intended), so whatever you set in that profile is going to be used by tshark (unless you force a different profile setting via command line parameter)