Wireshark · Wireshark-dev: Re: [Wireshark-dev] frame_data.abs_ts and pcap timestamp reference

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 9, 2009, at 6:32 AM, RUOFF LARS wrote:

> Is frame_data.abs_ts /* Absolute timestamp */ given in UTC or local
> time?

UTC.

> Can someone give me a hint on where to search for the code that does  
> the
> conversion before display (if any)?

abs_time_to_str(), etc. in epan/to_str.c.

> Do pcap files store timestamps in UTC or local time?

UTC.  See, for example, the pcap-savefile man page in libpcap 1.0.0  
and later, or

	http://wiki.wireshark.org/Development/LibpcapFileFormat

> If UTC, do they store the time zone?

In theory, yes.  In practice, no.  There is a time zone offset field  
in the file header, but no application (tcpdump, *thereal/*shark,  
etc.) has ever set it to anything other than 0, as far as I know (I  
know that libpcap, which is what most applications use to write the  
files, sets it to 0).