On Mar 15, 2004, at 11:20 AM, alex medvedev wrote:
is there an easy way to get the timezone information from the libpcap dump
file?
timezone info is in the pcap_t
No, it's not. The field is there, but nothing sets it to a meaningful value - it's not set on live captures at all (so it's zero, as a pcap_t is zeroed out), and, when reading a savefile, it's set to the value from the savefile's header - but, when writing a capture, libpcap sets the value in the save file's header to the value from the pcap_t from which the packets are coming.
I.e., there's no code anywhere in libpcap that actually sets "tzoff" in the pcap_t structure, or "thiszone" in the capture file header, to any value based on the (current) offset from UTC/TAI/whatever.
- This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
