Wireshark-users: Re: [Wireshark-users] Incorrect TimeStamp

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Thu, 24 Aug 2006 09:39:20 +0200
Koolrans wrote:

I am outputing the captured data to pcap file using the defined
specifications. For some reason I am getting negative value for the
time stamp. I tried 2 other decoders which display this correctly. I
have attached the capture file. I have verified (using Hex Editor)
that the data written to file is what I expect. Please ignore the mac
and ip values as I am only concentrating to learn to write a pcap
file. Can someone notice anything wrong I might be doing.
As noted in http://wiki.wireshark.org/Development/LibpcapFileFormat

ts_usec: the microseconds when this packet was captured, as an offset to /ts_sec/. /!\ Beware: this value shouldn't reach 1 second (1 000 000), in this case /ts_sec/ must be increased instead!

Regards, ULFL