Re: [tcpdump-workers] local timestamp recovery of .cap files

2009-05-15 Thread Guy Harris
On May 14, 2009, at 8:23 PM, Andrej van der Zee wrote: Hi, 2) does, but helpfully converts the time to local time (in which case, whoever decided to be helpful needs to be hit with said sock). I found that tcpdump with - converts to local time, but tcpdump -tt report GMT.

Re: [tcpdump-workers] Problem with generation of Pcap traces for

2009-05-15 Thread Guy Harris
On May 13, 2009, at 3:46 PM, Johan Mazel wrote: My reason of doing this is that I want to be able to aggregate different source of packets (eg.: I have eth0, eth1 eth2 and eth3 and I want to capture on eth0 and eth1 only and build a trace from these interfaces only). My goal is to

Re: [tcpdump-workers] local timestamp recovery of .cap files

2009-05-15 Thread Jefferson Ogata
On 2009-05-15 18:20, Guy Harris wrote: On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote: This has come up before, back when we were talking about the NG format. I guess I got confused by the current context; if pcap files are natively UTC (which I had thought they were until this thread