Skip to content

Conversation

@Sug2077
Copy link

@Sug2077 Sug2077 commented Oct 22, 2025

Summary

tshark 4.6.0 changed the JSON/EK output format of frame.time_epoch from a float-based Unix timestamp to an ISO 8601 string (e.g. 2025-10-22T02:20:33.634243780Z).
This caused ValueError: could not convert string to float when parsing packets with PyShark.

https://www.wireshark.org/docs/relnotes/wireshark-4.6.0

Absolute time fields, regardless of field display in the Packet Details, are always written in ISO 8601 format in UTC with -T json. This was already the case for -T ek since version 4.2.0. JSON is primarily a data interchange format read by software, so a standard format is desirable.

Fix

Updated Packet.sniff_time to detect ISO 8601 timestamps (ending with Z) and parse them using datetime.fromisoformat().
The old float-based parsing is kept for backward compatibility.

Compatibility

  • Works with both tshark ≤4.4 (float) and 4.6+ (ISO 8601)

  • No external dependencies added

Fixes #718

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ValueError: could not convert string to float, on packet.sniff_time, when using use_ek=True

1 participant