How do I see absolute time stamps in Wireshark?

Question

There is an example of pcap file opened in wireshark

The second column is time. Is it possible to see absolute timestamps here instead of relative?

Solution 1

(from comment)

A pcap file (from tcpdump or wireshark or AFAIK anything else using libpcap) already has absolute time; it's only the Wireshark display you need to adjust.

In the View menu click Time Display Format and choose one of the Time of Day options.

Solution 2

tcpdump has its own timestump options for.

-t
    Don't print a timestamp on each dump line. 
-tt
    Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and fractions of a second since that time, on each dump line. 
-ttt
    Print a delta (micro-second resolution) between current and previous line on each dump line. 
-tttt
    Print a timestamp, as hours, minutes, seconds, and fractions of a second since midnight, preceded by the date, on each dump line. 
-ttttt
    Print a delta (micro-second resolution) between current and first line on each dump line. 

More info you can find at tcpdump manpage.

Comments

[dave_thompson_085]

In the View menu click Time Display Format and choose one of the Time of Day options. (The file is already fine.)

[Admin]

@dave_thompson_085 Could you please submit your comment as an answer? It's the correct answer to the question.