Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 4289] Frame arrival times (pcap) are 1 hour more than timestamps in txt

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4289

--- Comment #3 from Jakub Zawadzki <darkjames@xxxxxxxxxxxxxxxx> 2009-12-07 07:21:16 PST ---
Created an attachment (id=4034)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4034)
Set timecode_default.tm_isdst to unknown before mktime()

(In reply to comment #2)
> I shouldn't need to set the TZ, since I want text2pcap to use the time as
> specified in the file (without any conversion).  To recap, if I don't set the
> TZ, then the frame time is +1 hour from the file.

If time in file is different that your current timezone (in your case GMT vs
EST) you need.

text2pcap is using mktime(), which is using your curent timezone, from man
file:
#v+
       The  mktime() function converts a broken-down time structure, expressed
       as local time, to calendar time representation.
#v-

> Just for kicks, I set TZ=UTC.  The frame time then becomes -4 hours from the
> file.

Wireshark is displaying time in your local time. EST is GMT-5 + 1 (hour for
DST) (right?)


Anyway if it's craziness for you. You can try this patch :)
If you want the same (local) time in wireshark you don't need to set TZ.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.