[pcap-ng-format] Issue #24: Need to specify the IDB if_tzone option format

Guy Harris guy at alum.mit.edu
Wed Aug 26 01:05:29 UTC 2015


On Aug 25, 2015, at 5:46 PM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:

> On Tue, Aug 25, 2015 at 5:12 PM, Stephen Donnelly
> <stephen.donnelly at avagotech.com> wrote:
>> Time stamps are noted as being in UTC, so presumably if_tzone is just a
>> display hint?
> 
> As far as I can tell, yes it's purely informational, and thus just an
> option. For example if some pcapng reading application wishes to show
> the packet timestamps in the timezone's time they were collected in,
> it can do that using the option

...assuming that the timezone in which they were collected has the same daylight savings time/summer time rules as the region in which you're reading it.

If not, you'd have to include something such as an IANA tzid, and have the application use the IANA time zone database to convert times to local times in other zones.


More information about the pcap-ng-format mailing list