The time
attribute of a sniffed packed actually denotes the time the packet was received, rather than the time it was sent. In fact, even the time Wireshark associates with a sniffed packet is the time it was received, as detailed in the official wiki.
There is no straight forward way of extracting the time a sniffed packet was sent. One can try measuring the network latency and extrapolating the send time based on that, but the accuracy of this approach is questionable. Another option is to extract the send time on the sending machine and transfer it somehow to the sniffing machine, either in-band if a controllable ad hoc protocol is in use or out-of-band otherwise, but both methods seem rather inelegant and are only feasible if the sending machine may be manipulated.
The values stored in the time
attribute are equivalent to the return value of the time.time()
function, which is the time in seconds since the epoch, i.e., the point where the time starts and is platform dependent.
These value may be converted into a more common time format (i.e. year, month, day, hour, etc…) in UTC by passing them to the time.gmtime()
function or in local time by passing them to the time.localtime()
function. In both cases a struct_time
object is returned, from which the components of the calendar date may be accessed as attributes. Passing on the returned struct_time
object to the time.asctime()
function converts it to a human readable string format, though better control of the human readable output is possible via the time.strftime()
function.
Python 3.4.3 (default, Nov 17 2016, 01:08:31)
[GCC 4.8.4] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import time
>>>
>>> timestamp = time.time()
>>> print(timestamp)
1505806452.8678658
>>>
>>> local_time = time.localtime(timestamp)
>>> print(local_time)
time.struct_time(tm_year=2017, tm_mon=9, tm_mday=19, tm_hour=10, tm_min=34, tm_sec=12, tm_wday=1, tm_yday=262, tm_isdst=1)
>>>
>>> human_time = time.asctime(local_time)
>>> print(human_time)
Tue Sep 19 10:34:12 2017
>>>
>>> my_human_time = time.strftime('%A, %d/%m/%y, %I:%M:%S %p', local_time)
>>> print(my_human_time)
Tuesday, 19/09/17, 10:34:12 AM
>>>