Wireshark-dev: Re: [Wireshark-dev] diameter dissector and ntp timestamp rollover

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 05 Jul 2007 20:52:33 +0200

Hi,

You could play around with ntp_fmt_ts(const guint8 *reftime) and see what happens. That function is found in packet-ntp.c and the source for the code in packet-diameter.c.

Thanx,
Jaap

cco wrote:

hi!

the people designing ntp came up with a timestamp format which rolls over every 136 years (weren't there already so many broken timestamp

formats?). here is the an execerpt from rfc2030 which clarifies things:

      As the NTP timestamp format has been in use for the last 17 years,
      it remains a possibility that it will be in use 40 years from now
      when the seconds field overflows. As it is probably inappropriate
      to archive NTP timestamps before bit 0 was set in 1968, a
      convenient way to extend the useful life of NTP timestamps is the
      following convention: If bit 0 is set, the UTC time is in the
      range 1968-2036 and UTC time is reckoned from 0h 0m 0s UTC on 1
      January 1900. If bit 0 is not set, the time is in the range 2036-
      2104 and UTC time is reckoned from 6h 28m 16s UTC on 7 February
      2036. Note that when calculating the correspondence, 2000 is not a
      leap year. Note also that leap seconds are not counted in the
      reckoning.

from a first look at the code it seems that the diameter dissector does not take into account this rollover, or?

bye now!
cristian