/usr/share/doc/wireshark-doc/wsug_html_chunked/ChWorkTimeFormatsSection.html is in wireshark-doc 2.0.2+ga16e22e-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>6.12. Time display formats and time references</title><link rel="stylesheet" type="text/css" href="ws.css"><meta name="generator" content="DocBook XSL Stylesheets V1.79.1"><link rel="home" href="index.html" title="Wireshark User Guide"><link rel="up" href="ChapterWork.html" title="Chapter 6. Working with captured packets"><link rel="prev" href="ChWorkIgnorePacketSection.html" title="6.11. Ignoring packets"><link rel="next" href="ChapterAdvanced.html" title="Chapter 7. Advanced Topics"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">6.12. Time display formats and time references</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ChWorkIgnorePacketSection.html">Prev</a> </td><th width="60%" align="center">Chapter 6. Working with captured packets</th><td width="20%" align="right"> <a accesskey="n" href="ChapterAdvanced.html">Next</a></td></tr></table><hr></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ChWorkTimeFormatsSection"></a>6.12. Time display formats and time references</h2></div></div></div><p>While packets are captured, each packet is timestamped. These timestamps will be
saved to the capture file, so they will be available for later analysis.</p><p>A detailed description of timestamps, timezones and alike can be found at:
<a class="xref" href="ChAdvTimestamps.html" title="7.4. Time Stamps">Section 7.4, “Time Stamps”</a>.</p><p>The timestamp presentation format and the precision in the packet list can be
chosen using the View menu, see <a class="xref" href="ChUseViewMenuSection.html#ChUseWiresharkViewMenu" title="Figure 3.5. The “View” Menu">Figure 3.5, “The “View” Menu”</a>.</p><p>The available presentation formats are:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<span class="emphasis"><em>Date and Time of Day: 1970-01-01 01:02:03.123456</em></span> The absolute date and time
of the day when the packet was captured.
</li><li class="listitem">
<span class="emphasis"><em>Time of Day: 01:02:03.123456</em></span> The absolute time of the day when the packet
was captured.
</li><li class="listitem">
<span class="emphasis"><em>Seconds Since Beginning of Capture: 123.123456</em></span> The time relative to the
start of the capture file or the first “Time Reference” before this packet
(see <a class="xref" href="ChWorkTimeFormatsSection.html#ChWorkTimeReferencePacketSection" title="6.12.1. Packet time referencing">Section 6.12.1, “Packet time referencing”</a>).
</li><li class="listitem">
<span class="emphasis"><em>Seconds Since Previous Captured Packet: 1.123456</em></span> The time relative to the
previous captured packet.
</li><li class="listitem">
<span class="emphasis"><em>Seconds Since Previous Displayed Packet: 1.123456</em></span> The time relative to the
previous displayed packet.
</li><li class="listitem">
<span class="emphasis"><em>Seconds Since Epoch (1970-01-01): 1234567890.123456</em></span> The time relative to
epoch (midnight UTC of January 1, 1970).
</li></ul></div><p>The available precisions (aka. the number of displayed decimal places) are:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<span class="emphasis"><em>Automatic</em></span> The timestamp precision of the loaded capture file format will be
used (the default).
</li><li class="listitem">
<span class="emphasis"><em>Seconds, Deciseconds, Centiseconds, Milliseconds, Microseconds or
Nanoseconds</em></span> The timestamp precision will be forced to the given setting. If
the actually available precision is smaller, zeros will be appended. If the
precision is larger, the remaining decimal places will be cut off.
</li></ul></div><p>Precision example: If you have a timestamp and it’s displayed using, “Seconds
Since Previous Packet”, : the value might be 1.123456. This will be displayed
using the “Automatic” setting for libpcap files (which is microseconds). If
you use Seconds it would show simply 1 and if you use Nanoseconds it shows
1.123456000.</p><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="ChWorkTimeReferencePacketSection"></a>6.12.1. Packet time referencing</h3></div></div></div><p>The user can set time references to packets. A time reference is the starting
point for all subsequent packet time calculations. It will be useful, if you
want to see the time values relative to a special packet, e.g. the start of a
new request. It’s possible to set multiple time references in the capture file.</p><p>The time references will not be saved permanently and will be lost when you
close the capture file.</p><p>Time referencing will only be useful if the time display format is set to
“Seconds Since Beginning of Capture”. If one of the other time display formats
are used, time referencing will have no effect (and will make no sense either).</p><p>To work with time references, choose one of the <span class="guimenu">Time Reference</span> items in
the <span class="guimenu">Edit</span> menu or from the pop-up menu of the “Packet List” pane. See
<a class="xref" href="ChUseEditMenuSection.html" title="3.6. The “Edit” menu">Section 3.6, “The “Edit” menu”</a>.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<span class="emphasis"><em>Set Time Reference (toggle)</em></span> Toggles the time reference state of the
currently selected packet to on or off.
</li><li class="listitem">
<span class="emphasis"><em>Find Next</em></span> Find the next time referenced packet in the “Packet List” pane.
</li><li class="listitem">
<span class="emphasis"><em>Find Previous</em></span> Find the previous time referenced packet in the “Packet
List” pane.
</li></ul></div><div class="figure"><a name="ChWorkTimeReference"></a><p class="title"><b>Figure 6.11. Wireshark showing a time referenced packet</b></p><div class="figure-contents"><div class="mediaobject"><img src="wsug_graphics/ws-time-reference.png" alt="wsug_graphics/ws-time-reference.png"></div></div></div><br class="figure-break"><p>A time referenced packet will be marked with the string *REF* in the Time
column (see packet number 10). All subsequent packets will show the time since
the last time reference.</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ChWorkIgnorePacketSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ChapterWork.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ChapterAdvanced.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">6.11. Ignoring packets </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Advanced Topics</td></tr></table></div></body></html>
|