I have a pcap file that is using a local timestamp that is not based in UTC time but uses the thiszone variable in the header to declare the offset between UTC and the local time. When I open the file in wireshark, the local time is reported as UTC and then the local time calculation happens as usual e.g. the file says the time should be 4PM EDT but with a four hour offset in thiszone. wireshark says UTC is 4PM and EDT is 12PM.
When I changed the thiszone variable in the header, the UTC remained 4PM and EDT remained 12PM regardless of the value of thiszone.
I might be misunderstanding what the thiszone variable of the global header does but from what it says here it seems that thiszone should alow for a non UTC timestamp to be used.
