["Clyde Hoadley" <hoadleyc@xxxxxxxx>]

Guy Harris wrote:
> 
> Try using WinDump.  First, just run it from a DOS window and see what
> time stamps it prints, to see if those are correct or not; then, try
> running it with the "-w" flag, saving the capture to a file, and try
> reading the file with both tcpdump and Ethereal, to see if those time
> stamps are correct or not.

Hum, this is interesting...  windump displays the time correctly but,
Ethereal still displays the time incorrectly when reading the windump
capture file.  ftp'ing the windump.cap file to Linux and reading it with
tcpdump, tcpdump displays the times incorrectly too.  I created a dump
file using tcpdump on Linux and ftp'ed it to windows.  Windump could
not read the dump file from tcpdump but, Ethereal could and, it displayed
the times correctly!  So, the problem must be outside of Ethereal.

Thanks for the explanation.

-- 
Clyde Hoadley
Information Technology Professional 2
Metropolitan State College of Denver
E-mail: hoadleyc@xxxxxxxx, 
Voice: (303) 556-5074, Cell: (720) 232-4737
http://clem.mscd.edu/~hoadleyc/