On Mar 16, 2015, at 12:20 AM, Michal Labedzki <michal.labedzki@xxxxxxxxx> wrote:
> I know this issue. I use "View -> Timeshift -> Shift all packet
> (+8:00:00)" what add 8 hours to all packets timestamp. Of course you
> must know what the time difference between logs, but to this day it
> works for me.
>
> Is TZ (and DST) saved in pcapng? I this it should.
There is an if_tzone option for the Interface Description Block; however, it's a 4-byte option, and thus presumably an integral value, and described only as "Time zone for GMT support (TODO: specify better).".
An alternative would be to have an option that contains an IANA Time Zone Database:
http://www.iana.org/time-zones
name. That's now an IANA database, so it now has at least *some* standing as an Official Standard rather than just a UN*X convention, even if Windows doesn't use it. (I seem to remember the possibility of storing TZ names being mentioned at one point, probably before the IANA took the database over, but don't remember what came of that discussion.)
