I try to use CALEA to sniff data from interface
and I use Wireshark open pcap files
every first packet in files Arrivl time is jan 1, 1970 ..
any wrong? or Can I settime stamp in package?
and if I using action type limited, what program to open it?
regard,
any one can help me?
Deleted because not related.
every first packet in files Arrivl time is jan 1, 1970
When router starts, it take few seconds for NTP client to update system clock.
So first packet is dated Jan 1, 1970.
@Dobby
CALEA is one of RouterOS packages.
http://wiki.mikrotik.com/wiki/Calea
HTH,
Deleted because not related.
Thank you for all response.
I was setup with my RB450G and run ROS later version (5.18)
MY Current config
[admin@450g] > ip address print
Flags: X - disabled, I - invalid, D - dynamic
0 192.168.10.1/24 192.168.10.0 ether2-Lan
1 192.168.30.1/30 192.168.30.0 ether4
2 192.168.31.1/30 192.168.31.0 ether5
3 10.1.1.1/32 10.1.1.1 br_lo
4 D x.x.x.x/32 x.x.x.x Gateway
[admin@450g] /ip firewall calea> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=forward action=sniff-pc sniff-target=192.168.10.1 sniff-target-port=5555
sniff-id=100 protocol=tcp out-interface=Gateway dst-port=80,81,443
[admin@450g] > tool calea print
Flags: X - disabled
0 case-id=100 case-name="test" intercept-ip=192.168.10.1 intercept-port=5555
action=pcap pcap-file-stop-interval=1h pcap-file-stop-size=1024
pcap-file-stop-count=0 pcap-file-hash-method=md5
[admin@450g] > system clock print
time: 23:15:17
date: jun/30/2012
time-zone-name: Asia/B..
gmt-offset: +07:00
[admin@450g] > system ntp client print
enabled: yes
mode: unicast
primary-ntp: 203.185.67.115
secondary-ntp: 0.0.0.0
dynamic-servers:
status: synchronized
and I export .dmp files to open with wireshark, Every files frame (Frame1) start time @ 1970-01-01
Can I put time into the package? and if I capture to XML Which program open it?
I have the same problem.
Date is always 1970 under WireShark when load a calea file, and my routerOS clock works fine.
RouterOS 5.26
Some idea??