I'd have to double-check, but I believe the event times changed as the result of the replay through NwLogPlayer. Basically, the time is that at which the logs were parsed.
Packets are a bit different. We often take PCAP's and play them through a packet decoder...forget what the timestamps in the PCAP actually were....yell and scream that things didn't import correctly, only to change our Time parameter to look at ALL data, which is when we find the actual pcap that kept the original timestamps.
So, I don't think it's an issue on the export, but rather on the import.
If you did want to preserve timestamps, you would want to do the import command in NwConsole. If you were to use tcpreplay to replay them, the timestamps would change.
Again...thats how I have seen it, but have never tried exporting an entire nwpdb file to attempt.
Chris
