Wireshark · Wireshark-dev: Re: [Wireshark-dev] wiretap - using as a library rather than coupled with Wireshark?

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 3, 2015, at 2:02 PM, Richard Kinder <rkinder@xxxxxxxxxxxxx> wrote:

> and I get something which is pcap + RT. I’m pushing the packet timestamp from the airopeek capture into the tsfts RT field,

"RT" as in "radiotap"?

If so, the packet timestamp should not be used as the TSF timestamp value; instead, if the PHDR_802_11_HAS_TSF_TIMESTAMP bit is set in the presence_flags field of the "struct ieee_802_11_phdr" pseudo-header, use the tsf_timestamp field of that structure as the TSFT field in the radiotap header, otherwise don't put a TSFT field into the radiotap header.