NITIN GOYAL wrote:
Hi
Is there any way in Wireshark where the pcaps when opened show the
timestamps according the timezone where it has been captured.
Foe example, i have few captures which has been captured in one timezone
and when i open them locally in another timezone the timestamps dispayed
got adjusted as per my timezone and i need to change the timezone of my
machine in order to see the accurate timestamps.
So, is there any preference or setting which can enable to view the
original timestamps?
The timezone information is not even stored in the PCAP file, so, no,
there's no way to automatically do that. The PCAP-NG file format does
allow the file to store the time zone but according to our Wiki page on
the subject:
http://wiki.wireshark.org/Development/PcapNg
The timezone feature is "not sufficiently specified."
As Tim mentioned, it's easy enough (if you know the time zone) to get
Wireshark to use the appropriate time zone. There is also a request:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2629
To allow you to do this from the GUI.
