I have files captured by NA's distributed sniffer pro (version 4.2 and 4.5 or .7). When I read them with Ethereal (version 0.9.x) or convert them with editcap, the timestamps are garbled: The day is right; the time is off by hours and the fraction of a second is negative. I've followed the discussion from 2 years ago, but what I read doesn't square with what I'm seeing in the packet headers. Is this still a problem for others? Chris Smith PS... I have some sample files and printouts from Sniffer with their version of the timestamps that I can post to an FTP server (it's a couple meg, zipped)
