On Dec 9, 2009, at 6:32 AM, RUOFF LARS wrote:
Is frame_data.abs_ts /* Absolute timestamp */ given in UTC or local
time?
UTC.
Can someone give me a hint on where to search for the code that does
the
conversion before display (if any)?
abs_time_to_str(), etc. in epan/to_str.c.
Do pcap files store timestamps in UTC or local time?
UTC. See, for example, the pcap-savefile man page in libpcap 1.0.0
and later, or
http://wiki.wireshark.org/Development/LibpcapFileFormat
If UTC, do they store the time zone?
In theory, yes. In practice, no. There is a time zone offset field
in the file header, but no application (tcpdump, *thereal/*shark,
etc.) has ever set it to anything other than 0, as far as I know (I
know that libpcap, which is what most applications use to write the
files, sets it to 0).
