Wireshark · Ethereal-users: RE: [Ethereal-users] Ethereal time format anomaly with libpcap fileformat

["Yoo, Gene" <Gene.Yoo@xxxxxxxxxxxxx>]

I would agree with Guy on option A, since, I just tried to import the
Ethereal (tcpdump/libpcap) data to Sniffer directly (I don't do nice
management report, I'm only here to make traces!) and had the same
results.  

Gene

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx] 
Sent: Monday, December 29, 2003 11:35 AM
To: Chris_Friedline@xxxxxxxxxxxxxxx
Cc: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Ethereal time format anomaly with libpcap
fileformat

On Mon, Dec 29, 2003 at 02:22:11PM -0500,
Chris_Friedline@xxxxxxxxxxxxxxx wrote:
> Thoughts?  Do I just need to convert everything to Sniffer before 
> using EtherPeek or did I stumble upon something in Ethereal?

Time stamps in libpcap format are stored as seconds since January 1,
1970, 00:00:00 GMT, plus microseconds.  DOS-based Sniffer files store
time stamps as local times.

I suspect that either

	1) EtherPeek's code for handling libpcap-format captures is
	   broken and doesn't handle UNIX-style time stamps correctly

or

	2) the time stamps are wrong on your server but the C library
	   functions Ethereal is using to process those time stamps is
	   compensating for that

and as I have no reason to believe that the C library functions would
compensate for that, I suspect the answer is 1).  The ability to read
libpcap-format captures in EtherPeek might be a new feature, so perhaps
there are some glitches in it (although Wildpackets' ProConvert has
handled them for a while).

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users