Wireshark · Ethereal-users: Re: [Ethereal-users] Date and Time of Day conversion sloowwww

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 17, 2003, at 6:59 AM, Jeremy M. Guthrie wrote:

> Is there some switch I need to pass ethereal so I can view traces with 
> date
> and time of day without having to wait 20 minutes for it to filter?

Either

	1) start Ethereal with the flag "-t ad":

		% man ethereal

			...

		       -t  Set the format of the packet timestamp displayed in the 
packet list
		           window.  The format can be one of 'r' (relative), 'a' 
(absolute),
		           'ad' (absolute with date), or 'd' (delta).  The relative 
time is
		           the time elapsed between the first packet and the current 
packet.
		           The absolute time is the actual time the packet was 
captured, with
		           no date displayed; the absolute date and time is the 
actual time
		           and date the packet was captured.  The delta time is the 
time since
		           the previous packet was captured.  The default is relative.

or

	2) start up Ethereal, select "Preferences" from the "Edit" menu, 
select "Columns", select the "Time" column", change "Column format:" to 
"Absolute date and time", click "Save", click "OK", exit Ethereal, and 
restart Ethereal - that'll set your column preferences so that the time 
stamp is always displayed as date and time of day (regardless of what 
you set it to from the command line or the GUI, so do that only if you 
*always* want it displayed that way).

> 0.10.0a
> is faster but I have a 50MB trace that has been converting for over 30
> minutes and is only 48% done.

The next release might have some further improvements (at least for 
GTK+ 1.2[.x] versions), and some future release might make it take next 
to no time (the latter wouldn't be a trivial change).