How to preserve timestamps in tshark output file?

1
votes

I'm using tshark to extract specific TCP streams and write that to an output pcap file using the -w option.

But, the frames in the output pcap do not have any timestamps or delta times (they're all zero while in the original pcap there are timestamps and delta times for the frames).

Is there any way to ensure that the original timestamps (from the original pcap file) are preserved in the output pcap?

I'm using TShark 1.10.5 (SVN Rev 54262 from /trunk-1.10) on MacOS.

Thanks!

1
wiresharkpcap

1 Answers

1
votes

the frames in the output pcap do not have any timestamps or delta times (they're all zero while in the original pcap there are timestamps and delta times for the frames).

That is what is technically known as a "bug". Please file it as a bug on the Wireshark Bugzilla; if you can attach your original pcap file for testing purposes, that would be good. (If not, please run the file command on it and show the results, just so we know what file type the input file is - it might, for example, be a pcap-ng file rather than a pcap file).