Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 154)

7.5.1. Set your computer's time correctly!

If you work with people around the world, it's very helpful to set your computer's time and time

zone right.

You should set your computers time and time zone in the correct sequence:

1. Set your time zone to your current location

2. Set your computer's clock to the local time

This way you will tell your computer both the local time and also the time offset to UTC.

Tip!

If you travel around the world, it's an often made mistake to adjust the hours of your

computer clock to the local time. Don't adjust the hours but your time zone setting in-

stead! For your computer, the time is essentially the same as before, you are simply in

a different time zone with a different local time!

Tip!

You can use the Network Time Protocol (NTP) to automatically adjust your computer

to the correct time, by synchronizing it to Internet NTP clock servers. NTP clients are

available for all operating systems that Wireshark supports (and for a lot more), for ex-

amples see: http://www.ntp.org/.

7.5.2. Wireshark and Time Zones

So what's the relationship between Wireshark and time zones anyway?

Wireshark's native capture file format (libpcap format), and some other capture file formats, such as

the Windows Sniffer, EtherPeek, AiroPeek, and Sun snoop formats, save the arrival time of packets

as UTC values. UN*X systems, and "Windows NT based" systems (Windows NT 4.0, 2000, XP,

Server 2003, Vista, Server 2008) represent time internally as UTC. When Wireshark is capturing, no

conversion is necessary. However, if the system time zone is not set correctly, the system's UTC

time might not be correctly set even if the system clock appears to display correct local time. "Win-

dows 9x based" systems (Windows 95, Windows 98, Windows Me) represent time internally as loc-

al time. When capturing, WinPcap has to convert the time to UTC before supplying it to Wireshark.

If the system's time zone is not set correctly, that conversion will not be done correctly.

Other capture file formats, such as the Microsoft Network Monitor, DOS-based Sniffer, and Net-

work Instruments Observer formats, save the arrival time of packets as local time values.

Internally to Wireshark, time stamps are represented in UTC; this means that, when reading capture

files that save the arrival time of packets as local time values, Wireshark must convert those local

time values to UTC values.

Wireshark in turn will display the time stamps always in local time. The displaying computer will

convert them from UTC to local time and displays this (local) time. For capture files saving the ar-

rival time of packets as UTC values, this means that the arrival time will be displayed as the local

time in your time zone, which might not be the same as the arrival time in the time zone in which

the packet was captured. For capture files saving the arrival time of packets as local time values, the

conversion to UTC will be done using your time zone's offset from UTC and DST rules, which

means the conversion will not be done correctly; the conversion back to local time for display might

undo this correctly, in which case the arrival time will be displayed as the arrival time in which the

packet was captured.

Advanced Topics

139

1 2 ... 149 150 151 152 153 154 155 156 157 158 159 ... 283 284

Wireshark - 1.0 Betriebsanweisung Seite 154