Wireshark · Ethereal-users: [Ethereal-users] Incorrect time display for decode of windows sniffer capture file.

["Bill Meier" <wmeier@xxxxxxxxxxx>]

I'm using windows ethereal 0.9.11 (glib 1.3.2. libz 1.1.4) on my home 
windows XP PC to display capture files saved from a windows sniffer at 
work.

When I set the display options to show date+time, the millisecs portion of 
the time shows as a negative number.

eg: 21.-403265;  the date shown is also not correct (i.e.: not the same as 
shown if I display the file with the NG sniffer program at work).

See attached .jpg for a snapshot.


Is this a known problem ? Something wrong about my install ? or what ?

(I also tried ethereal 0.9.12 with the same result).

Additional note:

After using Ethereal to filter packets for a particular TCP connection, and 
then saving the filtered packets (in windows sniffer format) and then 
loading the saved file, the times displayed correctly.

e.g.: 21.-403265 became 20.596735

If I just take the original capture file, save it (save_as) and then load 
the saved file, the times still display incorrectly.

Thanks in advance for any ideas, help.

Bill Meier


The following section of this message contains a file attachment
prepared for transmission using the Internet MIME message format.
If you are using Pegasus Mail, or any other MIME-compliant system,
you should be able to save it or view it from within your mailer.
If you cannot, please ask your system administrator for assistance.

   ---- File information -----------
     File:  ethereal 0.9.11 windows sniffer capture decode.jpg
     Date:  7 Jun 2003, 10:08
     Size:  20489 bytes.
     Type:  JPEG-image

Attachment: ethereal 0.9.11 windows sniffer capture decode.jpg
Description: JPEG image