Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 6952] Multiprotocol label Switching Echo - Timestamp UNIX

Date: Mon, 19 Mar 2012 20:44:05 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6952

Guy Harris <guy@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Platform|x86-64                      |All
         OS/Version|Windows 7                   |All

--- Comment #2 from Guy Harris <guy@xxxxxxxxxxxx> 2012-03-19 20:44:04 PDT ---
For some unknown reason, the code to handle NTP-encoded times does

#define NTP_BASETIME 2208988800ul
                                time_stamp.secs  = tvb_get_ntohl(tvb, start);
                                if (time_stamp.secs)
                                        time_stamp.secs -= NTP_BASETIME;

so it only converts the time from NTP format to UN*X format if the seconds part
of the time stamp is non-zero.

Perhaps those protocols that use NTP timestamps *and* treat zero specially - it
appears, according to RFC 4379, that some time stamp fields are set to zero:

4.3.  Sending an MPLS Echo Request

   An MPLS echo request is a UDP packet.  ...

        ...

   The TimeStamp Sent is set to the time-of-day (in seconds and
   microseconds) that the echo request is sent.  The TimeStamp Received
   is set to zero.

so perhaps the check for zero should be removed from the generic NTP time
handling code and the MPLS Echo dissector should check for zero in the echo
request packet's TimeStamp Received field and display it as "not set" if it's
zero.  If anybody complains that we're displaying dates from 1900 or displaying
a bogus value for time stamps (a 32-bit time_t doesn't support dates in 1900 on
at least some systems!), we can add special-casing of zero as appropriate in
the dissectors for the protocols in question.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.