Wireshark-dev: Re: [Wireshark-dev] Set capture to TZ blah?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Sat, 14 Mar 2015 15:34:50 -0400
On 03/14/2015 02:16 PM, Guy Harris wrote:


On Mar 14, 2015, at 8:00 AM, Niels de Vos <ndevos@xxxxxxxxxx> wrote:


When I have captures and logs that do not match the timezone, I use the
TZ environment variable to read the captures in the timezone of the
logs, like:

    $ TZ=America/New_York tshark -r /path/to/capture.pcap.gz ....

or

    $ TZ=America/New_York wireshark /path/to/capture.pcap.gz


That would work on systems using the IANA tz database (and using the new tz naming scheme; I'm not sure whether Solaris does), so it'd work on, at minimum, most if not all Linux distributions, *BSD, and OS X.

However, it doesn't work on, for example, Windows, which doesn't use the IANA tz database.
(I think) the only thing that doesn't work on Windows is specifying the timezone in that format. At least according to: 

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2629#c4
you can still set the TZ variable on Windows (in a command shell) and Wireshark will use it. Presumably you just need to know the right format.
(Personally I'm more used to doing things like TZ=PDT than these fancy new-fangled TZ names; maybe Windows still uses that format--as that comment suggests?)