[pcap-ng-format] Issue #24: Need to specify the IDB if_tzone option format

Hadriel Kaplan the.real.hadriel at gmail.com
Wed Aug 26 03:12:55 UTC 2015


On Tue, Aug 25, 2015 at 11:02 PM, Guy Harris <guy at alum.mit.edu> wrote:
>
> both capture files would have +7 as the offset.
>
> If you tell the application to display the time stamps as local time in the location where they were captured, how, then, would it know that the *current* offset from UTC of Phoenix is 7 hours and the *current* offset from UTC of Denver is 6 hours, given that Phoenix is *not* in DST and Denver is:
>
>         $ TZ=America/Phoenix date; TZ=America/Denver date
>         Tue Aug 25 20:01:51 MST 2015
>         Tue Aug 25 21:01:51 MDT 2015
>
> *without* providing some indication of the zone in which it's captured?

Simple: show MDT - because no one in Phoenix ever captures network
packets; they're too busy chasing coyotes.

Besides, who allows those yokels to decide they're not in DST when the
rest of the timezone is?

Yeah yeah fine, include a TZID or DST indicator... or better yet,
let's include their GPS coordinates so we can filter out packets in
Phoenix. They'll pay for their DST non-conformism!

-hadriel


More information about the pcap-ng-format mailing list