Wireshark · Ethereal-dev: [Ethereal-dev] How to read/import and display capture files with 1ns timestamp resolution?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Hi List!

I currently ran into a problem to get captured data into Ethereal with 1ns timestamps from a special capture hardware.

The libpcap format has a minimum timestamp resolution of 1us:
	guint32	ts_sec;		/* timestamp seconds */
	guint32	ts_usec;	/* timestamp microseconds */

I could save the data with ns resolution in the us timestamp part (guint32 would be large enough to handle this) and tweak the display (e.g. using a preference), but this would be very ugly as it would require to switch this pref all the time when working with both formats.

Another solution would be to implement the PCAPng format mentioned some time before on this list. Using this format one can keep the timestamp resolution inside the capture file.

Any other (possibly more simple) ideas? Probably using an already existing format which supports this ns timestamps just today?

Regards, ULFL
_________________________________________________________________________
Mit der Gruppen-SMS von WEB.DE FreeMail können Sie eine SMS an alle 
Freunde gleichzeitig schicken: http://freemail.web.de/features/?mc=021179