Wireshark · Wireshark-users: Re: [Wireshark-users] Time Zone effect in Timestamps of Pcap

[Dale McCoy <dalestan@xxxxxxxxx>]

On Sun, Oct 30, 2011 at 10:53, NITIN GOYAL <nitinkumgoyal@xxxxxxxxx> wrote:
> Hi
> I have a very basic question. I capture a pcap with wireshark in some X
> timezone. Now, I send that pcap to some other time zone and now i see
> the timestamps changed as per the new time zone.
> Now, when i create pdml at both timezone they different in the timestamps.
> Is ther any way i wireshark where i can see the original timestamps and they
> wont change even if i send the pcap to any time zone.

Yes and no.

Unless I miss my guess, the pcap has timestamps stored in UTC. You can
set Wireshark to display UTC timestamps, regardless of the local
timezone, but I'm not aware of any way to force Wireshark to display
any particular (other, i.e. non-zero) timezone offset.

Dale McCoy