主页 / server / 问题 / 772736
Accepted
user1700494
Asked: 2016-04-26 05:00:55 +0800 CST

如何在 Wireshark 中查看绝对时间戳？

  • 772

有一个pcap打开的文件示例wireshark 在此处输入图像描述

第二列是时间。是否可以在这里看到绝对时间戳而不是相对时间戳？

tcpdump wireshark

2 个回答

  1. Best Answer

    （来自评论）

    pcap 文件（来自 tcpdump或wireshark 或 AFAIK 任何其他使用 libpcap 的文件）已经有绝对时间；它只是您需要调整的Wireshark 显示。

    在View菜单中单击Time Display Format并选择其中一个Time of Day选项。

    • 4

  2. tcpdump 有自己的时间戳选项。

    -t
    Don't print a timestamp on each dump line. 
-tt
    Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and fractions of a second since that time, on each dump line. 
-ttt
    Print a delta (micro-second resolution) between current and previous line on each dump line. 
-tttt
    Print a timestamp, as hours, minutes, seconds, and fractions of a second since midnight, preceded by the date, on each dump line. 
-ttttt
    Print a delta (micro-second resolution) between current and first line on each dump line.

    您可以在 tcpdump 手册页中找到更多信息。

    • 2

相关问题