fix: support ISO 8601 timestamp format in Packet.sniff_time for tshark 4.6+ JSON/EK output #743
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
tshark 4.6.0 changed the JSON/EK output format of frame.time_epoch from a float-based Unix timestamp to an ISO 8601 string (e.g. 2025-10-22T02:20:33.634243780Z).
This caused ValueError: could not convert string to float when parsing packets with PyShark.
https://www.wireshark.org/docs/relnotes/wireshark-4.6.0
Fix
Updated Packet.sniff_time to detect ISO 8601 timestamps (ending with Z) and parse them using datetime.fromisoformat().
The old float-based parsing is kept for backward compatibility.
Compatibility
Works with both tshark ≤4.4 (float) and 4.6+ (ISO 8601)
No external dependencies added
Fixes #718