nRF51 --> wireshark , absolute time (as in not a date in 1970 but 2018-04-15-ish :) )

[NLScott]

Using some of our nRF51 dongles as sniffers to debug BLE.

Sniffer software --> "w" --> Wireshark, no problems.

Post processing wireshark export *.csv files. No problems

Cannot figure out how to get real time in the wireshark .csv files.

Multitudinous help online about selecting time format in Wireshark, but seemingly not applicable as the dates reported are in 1970 & about 13:00?.

That is, they seem fine, as some offset from something, eg start time +our timezone +1 hour :( ?

Seen suggestions that the dates as set in pcap. Can't see how to change this.

Anyway - anyone know how to get a real date into the process.

Of course, tight schedule, need a workable solution pronto.

Many thanks, in advance, any pointers appreciated.

[David Edwin]

Timeline in the sniffer is relative and it has 2 points that are usable and 1 that is not.

1. The timestamp that wireshark places is the PC timestamp when the packet is received in Wireshark.

2. The timestamp that is included in the packet i.e. delta time end to start is being measured in the firmware and is the delta from the end of one packet to the start of the next. This can be used to build the timeline in combination with the lengths of the sniffed packets. You must take care to account for packet overhead to get the timeline correct.

3 (not usable): the delta time start to start is buggy and is not reliable. This is calculated in wireshark.

===CSV===

It may be possible to use tshark and dump it out in CSV but tshark does not support the BTLE sniffer as it requires a device to be selected.

Can you use the python sniffer API that is bundled with the sniffer (see snifferAPI.zip) or the sniffer library from adafruit to achieve what you want ? 

Does this help ?
David