User Guide

6.11. Time display formats and time
references
While packets are captured, each packet is timestamped. These timestamps will be saved to the cap-
ture file, so they will be available for later analysis.
A detailed description of timestamps, timezones and alike can be found at: Section 7.4, “Time
Stamps”.
The timestamp presentation format and the precision in the packet list can be chosen using the View
menu, see Figure 3.5, “The "View" Menu”.
The available presentation formats are:
• Date and Time of Day: 1970-01-01 01:02:03.123456 The absolute date and time of the day
when the packet was captured.
• Time of Day: 01:02:03.123456 The absolute time of the day when the packet was captured.
• Seconds Since Beginning of Capture: 123.123456 The time relative to the start of the capture
file or the first "Time Reference" before this packet (see Section 6.11.1, “Packet time referen-
cing”).
• Seconds Since Previous Captured Packet: 1.123456 The time relative to the previous captured
packet.
• Seconds Since Previous Displayed Packet: 1.123456 The time relative to the previous dis-
played packet.
• Seconds Since Epoch (1970-01-01): 1234567890.123456 The time relative to epoch (midnight
UTC of January 1, 1970).
The available precisions (aka. the number of displayed decimal places) are:
• Automatic The timestamp precision of the loaded capture file format will be used (the default).
• Seconds, Deciseconds, Centiseconds, Milliseconds, Microseconds or Nanoseconds The
timestamp precision will be forced to the given setting. If the actually available precision is
smaller, zeros will be appended. If the precision is larger, the remaining decimal places will be
cut off.
Precision example: If you have a timestamp and it's displayed using, "Seconds Since Previous Pack-
et", : the value might be 1.123456. This will be displayed using the "Automatic" setting for libpcap
files (which is microseconds). If you use Seconds it would show simply 1 and if you use Nano-
seconds it shows 1.123456000.
6.11.1. Packet time referencing
The user can set time references to packets. A time reference is the starting point for all subsequent
packet time calculations. It will be useful, if you want to see the time values relative to a special
packet, e.g. the start of a new request. It's possible to set multiple time references in the capture file.
Warning!
The time references will not be saved permanently and will be lost when you close the
capture file.
Working with captured packets
127