Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [PATCH] USB setup hdr

From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Sun, 15 Oct 2006 10:35:22 +0000
On 10/15/06, Paolo Abeni <paolo.abeni@xxxxxxxx> wrote:
Hello,

On Sat, 2006-10-14 at 21:42 +0000, ronnie sahlberg wrote:
> In the example capture unplug_mouse2.cap
> it appears that the timestamp for the packet is not generated properly.
> All packets show up as JAN 1 1970.
>
> 1, Can you have a look at the timestamp generation of packets when
capturing.

The issue is that current kernel code provides the timestamp compressing
a struct timeval in only 32 bits; 8 bits for tv_sec field and 24 for
tv_usec. There is some buzz on the lkml to update the usbmon module;
perhaps this is going to be fixed.

The libpcap code could just ignore what the usbmon module specifies
and just explicitely call gettimeofday() instead.

USB packets probably arrive at such very slow rate anyway that a few
gettimeofday() calls are unlikely to cause any performance issues.



However,   much more important is the apparent offset by one for the
captured data which renders all data (excluding usb header and setup)
semi-useless.