[pcap-ng-format] Issue #24: Need to specify the IDB if_tzone option format

Hadriel Kaplan the.real.hadriel at gmail.com
Wed Aug 26 02:18:08 UTC 2015


On Tue, Aug 25, 2015 at 9:05 PM, Guy Harris <guy at alum.mit.edu> wrote:
>
> On Aug 25, 2015, at 5:46 PM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:
>>
>> As far as I can tell, yes it's purely informational, and thus just an
>> option. For example if some pcapng reading application wishes to show
>> the packet timestamps in the timezone's time they were collected in,
>> it can do that using the option
>
> ...assuming that the timezone in which they were collected has the same daylight savings time/summer time rules as the region in which you're reading it.
>
> If not, you'd have to include something such as an IANA tzid, and have the application use the IANA time zone database to convert times to local times in other zones.

Why would it matter, if we specified the if_tzone was always in
standard time? +8 hours = PST, no matter whether DST is in effect or
not. The pcapng reading application can figure out if, for the given
time in the timestamps and your standard timezone, DST is in effect or
not for your timezone, can't it?  Or save the TZID - I don't care,
whatever's easier/simpler/less-error-prone. :)

-hadriel


More information about the pcap-ng-format mailing list