Home / server / Questions / 772736
Accepted
user1700494
Asked: 2016-04-26 05:00:55 +0800 CST

How do I see absolute time stamps in Wireshark?

  • 772

There is an example of pcap file opened in wireshark enter image description here

The second column is time. Is it possible to see absolute timestamps here instead of relative?

tcpdump wireshark

2 Answers

  1. Best Answer

    (from comment)

    A pcap file (from tcpdump or wireshark or AFAIK anything else using libpcap) already has absolute time; it's only the Wireshark display you need to adjust.

    In the View menu click Time Display Format and choose one of the Time of Day options.

    • 4

  2. tcpdump has its own timestump options for.

    -t
    Don't print a timestamp on each dump line. 
-tt
    Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and fractions of a second since that time, on each dump line. 
-ttt
    Print a delta (micro-second resolution) between current and previous line on each dump line. 
-tttt
    Print a timestamp, as hours, minutes, seconds, and fractions of a second since midnight, preceded by the date, on each dump line. 
-ttttt
    Print a delta (micro-second resolution) between current and first line on each dump line.

    More info you can find at tcpdump manpage.

    • 2