Wireshark · Ethereal-users: Re: [Ethereal-users] >> Lastest Network General Sniffer format Displaying Wrong Date/Time <<

[Guy Harris <gharris@xxxxxxxxx>]

Guy Harris wrote:

> The time stamps in Windows Sniffer captures are not always interpreted
> correctly by Ethereal; unfortunately, we have not yet been able to
> reverse-engineer the file sufficiently to figure out what data in the file
> specifies how to compute the time stamps correctly.

James Fields and Kevin Johnson have discovered that there's a field in 
the file header of *some* captures that contains the units of the time 
stamp (in other captures, it's zero).  I've checked in their patch to 
fetch the time stamp units from there; the next release should have that 
change (and possibly other changes to the NetXRay/Windows Sniffer file 
reading code as well).

That fix might or might not fix the problem reported.