Wireshark · Wireshark-users: Re: [Wireshark-users] Issue related to the Timestamps in different TimeZones

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

NITIN GOYAL wrote:
> Hi
>
> Is there any way in Wireshark where the pcaps when opened show the 
> timestamps according the timezone where it has been captured.
>
> Foe example, i have few captures which has been captured in one timezone 
> and when i open them locally in another timezone the timestamps dispayed 
> got adjusted as per my timezone and i need to change the timezone of my 
> machine in order to see the accurate timestamps.
>
> So, is there any preference or setting which can enable to view the 
> original timestamps?

The timezone information is not even stored in the PCAP file, so, no, 
there's no way to automatically do that.  The PCAP-NG file format does 
allow the file to store the time zone but according to our Wiki page on 
the subject:

http://wiki.wireshark.org/Development/PcapNg

The timezone feature is "not sufficiently specified."

As Tim mentioned, it's easy enough (if you know the time zone) to get 
Wireshark to use the appropriate time zone.  There is also a request:

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2629

To allow you to do this from the GUI.