On Dec 3, 2012, at 5:37 AM, Erik Hjelmvik <erik.hjelmvik@xxxxxxxxx> wrote:
> The Pcap-NG file format has support for using nano-second resolution
> timestamps, and from what I understand Wireshark uses nanoseconds
> internally. However, I'm not able to get Wireshark or dumpcap to write
> pcapng files with nanosecond resolution. All I get is the default
> microsecond timestamps.
>
> Is there some switch or setting in Wireshark or dumpcap that I can use
> in order to enable nanosecond timestamps in the output pcapng file?
Given that dumpcap uses libpcap/WinPcap to do capturing, and libpcap/WinPcap deliver only microsecond-resolution time stamps, no, there's no such setting. The pcap API is explicitly specified to deliver seconds-and-microseconds, so an API would have to be added to it to request higher-resolution time stamps.
