I have a linux server which captures network pcap files and save it to a CIFS shared drive. I have found out that the creation time and modified time of the pcap files seems to be the same. Which shouldn't be, as each file has 10 seconds of data so the creation time should be 10 seconds older than the modified time. If I'm correctly understanding the time attributes. I need this difference as the software with which I extract the files from the shared drive fixes the time span with start time as creation time of first file and end time as "last write /modified time" of the last file. Is this happening because of a linux bug? I know there will be a difference in the creation time and modified time as I have seen it before on the system few months ago.


Linux doesn't have an easily accessible file creation timestamp (but see Stéphane's comment below). Running stat on a file I've just created shows a Access, Modify and Change timestamp - but no creation.

I'm guessing that maybe the CIFS share you viewed a few months ago was not created by a Linux system? Maybe it was a Windows system shared by CIFS?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.