I've spent a little time working through how to use the TZ stored
in netxray (Windows Sniffer) capture files when displaying packet
frame times.
I'd like to get some feedback if the following approach and patch
seem reasonable.
Background
----------
Windows Sniffer capture files (v2.2 and presumably v2.3) files have a
timezone field in the file header (in addition to the UTC time field).
It would be nice for Ethereal to display frames for these files with a time
which reflects the time (local) time of the capture even if the machine
running Ethereal is in a different timezone that the machine which made the
original capture.
Currently Ethereal displays frame times in the "local" time of the machine
running Ethereal (using the C library function 'localtime').
So: if a capture is made in the EST timezone and then displayed on a machine
in the CST timezone the times displayed will be off (earlier) by one hour.
Proposal
--------
In netxray.c determine the UTC 'start_time' by using the UTC time from the
file header adjusted by the difference in hours between the capture
file TZ and the local machine TZ.
In the above example this would mean adjusting the UTC time by adding one hour.
I've attached a patch for netxray.c which determines the timezone delta
and then adjusts the UTC 'start_time' appropriately.
Again, all comments are welcome.
[[[
Another possible solution is to somehow 'adjust' the TZ being used by 'localtime'
(setting the global variable used by 'localtime' ? ['timezone' or something similar ?]).
I didn't see a portable way to do this (although I'm certainly no expert on the
details of timezone implementation in various C runtime libraries).
(Doing something like this would also have the drawback of affecting all usage of
localtime within the program and not just for displaying the frame times).
]]]
Bill Meier
The following section of this message contains a file attachment
prepared for transmission using the Internet MIME message format.
If you are using Pegasus Mail, or any other MIME-compliant system,
you should be able to save it or view it from within your mailer.
If you cannot, please ask your system administrator for assistance.
---- File information -----------
File: netxray_timezone_patch.txt.gz
Date: 15 Jan 2006, 11:56
Size: 1248 bytes.
Type: Unknown
Attachment:
netxray_timezone_patch.txt.gz
Description: Binary data
