Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] How to read/import and display capture files with 1ns timesta

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>
Date: Wed, 27 Jul 2005 16:19:34 +0200
Hi Ulf,

just implement your own format. It is not difficult to do at all...

Best regards
Michael

On Jul 27, 2005, at 16:12 Uhr, Ulf Lamping wrote:


Hi List!

I currently ran into a problem to get captured data into Ethereal with 1ns timestamps from a special capture hardware.

The libpcap format has a minimum timestamp resolution of 1us:
	guint32	ts_sec;		/* timestamp seconds */
	guint32	ts_usec;	/* timestamp microseconds */

I could save the data with ns resolution in the us timestamp part (guint32 would be large enough to handle this) and tweak the display (e.g. using a preference), but this would be very ugly as it would require to switch this pref all the time when working with both formats.

Another solution would be to implement the PCAPng format mentioned some time before on this list. Using this format one can keep the timestamp resolution inside the capture file.

Any other (possibly more simple) ideas? Probably using an already existing format which supports this ns timestamps just today?

Regards, ULFL
_______________________________________________________________________ __
Mit der Gruppen-SMS von WEB.DE FreeMail können Sie eine SMS an alle
Freunde gleichzeitig schicken: http://freemail.web.de/features/?mc=021179



_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev