Wireshark-dev: Re: [Wireshark-dev] Set capture to TZ blah?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 16 Mar 2015 12:35:59 -0700
On Mar 16, 2015, at 12:20 AM, Michal Labedzki <michal.labedzki@xxxxxxxxx> wrote:

> I know this issue. I use "View -> Timeshift -> Shift all packet
> (+8:00:00)" what add 8 hours to all packets timestamp. Of course you
> must know what the time difference between logs, but to this day it
> works for me.
> 
> Is TZ (and DST) saved in pcapng? I this it should.

There is an if_tzone option for the Interface Description Block; however, it's a 4-byte option, and thus presumably an integral value, and described only as "Time zone for GMT support (TODO: specify better).".

An alternative would be to have an option that contains an IANA Time Zone Database:

	http://www.iana.org/time-zones

name.  That's now an IANA database, so it now has at least *some* standing as an Official Standard rather than just a UN*X convention, even if Windows doesn't use it.  (I seem to remember the possibility of storing TZ names being mentioned at one point, probably before the IANA took the database over, but don't remember what came of that discussion.)