ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 6179] Allow time-shifting of the packet trace

Date: Wed, 17 Aug 2011 03:39:23 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6179

--- Comment #28 from Jim Young <jyoung@xxxxxxx> 2011-08-17 03:39:19 PDT ---
Created an attachment (id=6838)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6838)
Simple 20 packet ping exchange

Hello Edwin,

Really nice work!

But I think I've stumbled onto another small buglet.

Using: Version 1.7.0-SVN-38573 (SVN Rev 38573 from /trunk)

Running on Mac OS 10.6.8 (Darwin 10.8.0), with locale .UTF-8, with libpcap
version 1.0.0, with libz 1.2.3, GnuTLS 2.6.2, Gcrypt 1.4.6.

I see an unexpected 0.000000001 time shift discrepancy when I apply a specific
time shift to set the first packet's time to start exactly at midnight.  

Oddly I do NOT see this same issue using the same SVN version on Windows XP. I
haven't tried replicating the issue on a Linux system.

I've attached a simply trace file (myping2.pcap) to illustrate the the issue
but the same thing happened with any trace file I've tested with.

Starting with attached myping2.pcap trace, if you select frame 1 and expand the
"Frame" packet details you should see something like:

NOTE: Opening this trace on a workstation with another timezone (!EDT) will
probably result in a different time value.  Adjust time shift value as needed.

> Arrival Time: Aug 14, 2011 21:58:43.469358000 EDT
> [Time shift for this packet: 0.000000000 seconds]

If you open the Time Shift dialog and use the "Shift all packets" feature with
a value of "-21:58:43.469358" we expect to see:

> Arrival Time: Aug 14, 2011 00:00:00.000000000 EDT
> [Time shift for this packet: -79123.469358000 seconds] 

But on OSX I actually see:

> Arrival Time: Aug 14, 2011 00:00:00.000000001 EDT
> [Time shift for this packet: -79123.469357999 seconds]

I haven't had an opportunity to look at the code to determine why we might have
the 0.000000001 discrepancy on OSX.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.