[pcap-ng-format] Issue #24: Need to specify the IDB if_tzone option format

Hadriel Kaplan the.real.hadriel at gmail.com
Wed Aug 26 00:46:45 UTC 2015


On Tue, Aug 25, 2015 at 5:12 PM, Stephen Donnelly
<stephen.donnelly at avagotech.com> wrote:
> Time stamps are noted as being in UTC, so presumably if_tzone is just a
> display hint?

As far as I can tell, yes it's purely informational, and thus just an
option. For example if some pcapng reading application wishes to show
the packet timestamps in the timezone's time they were collected in,
it can do that using the option; or ignore it and show packet times in
the application's local timezone; or it can show them in UTC, or
whatever. It has other uses too, obviously, but the point is it's just
extra info. (nice to have though)

-hadriel


More information about the pcap-ng-format mailing list