Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: some netxray traces off by time factor

[Guy Harris <gharris@xxxxxxxxx>]

Matt Jibson wrote:

> The working file:
> hdr.timeunit = 2
> hdr.realtick = 0x001234de = 1193182
> It's timeunit thus ends up as 1193182, since hdr.realtick != 0.
>
> The broken  file:
> hdr.timeunit = 0
> hdr.realtick = 0x369e99 = 3579545
> It's timeunit is 3579545, since hdr.realtick != 0.
> This broken file is fixed by: timeunit /= 3.579545, which yields a
> timeunit of 1000000. This corresponds to TpS[0], or TpS[hdr.timeunit].
> This is important around line 420 of wiretap/netxray.c.

Are there any files with hdr.timeunit = 0 and a non-zero hdr.realtick 
where the time stamp tick is the value from hdr.realtick, rather than 1 
microsecond?  (This question is asked of the audience at large, 
including the guys who discovered hdr.realtick in the first place.)

I.e., does hdr.timeunit mean the time stamp units are 1 microsecond 
regardless of what's in hdr.realtick, with hdr.realtick used only for 
hdr.timeunit = 2 and *maybe* hdr.timeunit = 1?