Wireshark · Ethereal-users: Re: [Ethereal-users] how to modify packet timestamp using ethereal ???

[Sake Blok <sake@xxxxxxxxxx>]

On Tue, Apr 04, 2006 at 11:54:04PM -0700, Guy Harris wrote:
> tony vong wrote:
> >How do you modify pcap timestamp using ethereal ?
> 
> You don't.  Ethereal doesn't support that.

That's where editcap comes in handy, from the man-page:

-t <time adjustment>

Sets the time adjustment to use on selected packets. If the -t flag is used to specify a time adjustment, the specified adjustment will be applied to all selected packets in the capture file. The adjustment is specified as [-]seconds[.fractional seconds]. For example, -t 3600 advances the timestamp on selected packets by one hour while -t -0.5 reduces the timestamp on selected packets by one-half second. 
This feature is useful when synchronizing dumps collected on different machines where the time difference between the two machines is known or can be estimated.


In ethereal there is always the option to make a time-reference (right-click
on a packet). That way you can also synchronize the display of two open 
capture-files.


I hope this helps, Cheers,


Sake