TcpDump: showing the absolute timestamp (date + time) of pcap file

timestamp pcap tcpdump
Alex picture Alex · Jan 19, 2018 · Viewed 14k times · Source

I want to see the absolute timestamp of the packets in a pcap file using tcpdump. When I use the command tcpdump -r mypcapfiile it only shows the time,  

03:21:14.804778 IP static.vnpt.vn.51193 > 192.168.0.146.smtp

how can read the date as well?

Answer

pchaigno picture pchaigno · Jan 19, 2018

You can use the -tttt option:

$ tcpdump -tttt -nr tmp.pcap 
reading from file tmp.pcap, link-type EN10MB (Ethernet)
2018-01-19 17:50:43.275918 IP 172.24.0.97.45386 > 93.153.221.29.80: Flags [.], ack 3335572340, win 251, options [nop,nop,TS val 98777655 ecr 230462279], length 0
2018-01-19 17:50:43.287273 IP 93.153.221.29.80 > 172.24.0.97.45386: Flags [.], ack 1, win 285, options [nop,nop,TS val 230464839 ecr 98706059], length 0
2018-01-19 17:50:44.138480 ARP, Request who-has 172.24.0.73 tell 172.24.0.78, length 46
2018-01-19 17:50:45.162482 ARP, Request who-has 172.24.0.73 tell 172.24.0.78, length 46

Related questions

How do you get a timestamp in JavaScript?

How can I get a timestamp in JavaScript? Something similar to Unix timestamp, that is, a single number that represents the current time and date. Either as a number or a string.

Read More
NOW() function in PHP

Is there a PHP function that returns the date and time in the same format as the MySQL function NOW()? I know how to do it using date(), but I am asking if there is a function only for this. …

Read More
Should I use the datetime or timestamp data type in MySQL?

Would you recommend using a datetime or a timestamp field, and why (using MySQL)? I'm working with PHP on the server side.

Read More