Wireshark · Wireshark-users: Re: [Wireshark-users] Timestamps wrong on merged files

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Justin Alcorn wrote:
> I have 2 traces from a Wild Packets appliance that I need to merge. 
> They merge fine, but the timestamps are off by 6.38 seconds.  Turns out
> that the time syncing was broken on one of the appliances.  (Not my
> appliances, I had to ask favors to get the packet traces).
> 
> 
> Is there any utility to go into the one packet trace and push it's
> timestamps forward by 6.38 seconds, so that the merged files are
> readable?  An option to mergecap perhaps?

You can use editcap to do this. See the '-t' option at
http://www.wireshark.org/docs/man-pages/editcap.html