Wireshark · Ethereal-dev: Re: [Ethereal-dev] Issues reading from a pipe

[Guy Harris <gharris@xxxxxxxxx>]

Thomas Steffen wrote:

> 5. Libpcap has a 64bit bug.

It had one, but it hasn't had that one for a long time.

> It uses struct timeval ts in the file header,

There's no "struct timeval" in the file header, i.e. in the header at 
the beginning of the file.

At least as of libpcap 0.7, and this might date back as far as 0.6, 
there is a "struct pcap_timeval" in the packet header, i.e. the header 
at the beginning of each packet.

> while contains two "long" variables.

"struct pcap_timeval" has two "bpf_int32" values, which are 32 bits.