如何在Wireshark中查看绝对时间戳？

在wireshark打开了一个pcap文件的例子在这里输入图像说明

第二列是时间。有没有可能在这里看到绝对时间戳，而不是相对的？

（来自评论）

一个pcap文件（从tcpdump 或 wireshark或AFAIK其他任何使用libpcap）已经有绝对的时间; 它只是你需要调整的Wireshark显示器 。

在“ View菜单中，单击“ Time Display Format然后selectTime of Day选项之一。

tcpdump有它自己的时间戳选项。

 -t Don't print a timestamp on each dump line. -tt Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and fractions of a second since that time, on each dump line. -ttt Print a delta (micro-second resolution) between current and previous line on each dump line. -tttt Print a timestamp, as hours, minutes, seconds, and fractions of a second since midnight, preceded by the date, on each dump line. -ttttt Print a delta (micro-second resolution) between current and first line on each dump line.

更多信息你可以在tcpdump的manpagefind。