Hi Marco you are right, the pcap header is nsec but the time in the packet header is actually usec, thus wireshark treats it as nsec, I made some changes to libpcap on github, please update and let me know if it fixes this issue.
Alfredo > On 02 Jun 2016, at 11:24, Marco Kwok <[email protected]> wrote: > > Hi Alfredo, > > Yes, I opened it on wireshark but the time stamp is incorrect. It shift the > whole fraction by 1000 times as follows. > <bpcap-min.png> > ​Best, > Mark > > 2016-06-02 16:38 GMT+08:00 Alfredo Cardigliano <[email protected] > <mailto:[email protected]>>: > Hi Mark > the pcap is in nsec format, did you open it with wireshark? It seems the nsec > part is correct, it could be a visualisation issue in tcpdump. > > Alfredo > >> On 02 Jun 2016, at 07:56, Marco Kwok <[email protected] >> <mailto:[email protected]>> wrote: >> >> Hi Alfredo, >> >> Ah, yes I forgot to attach the file. Here it is. >> >> Best, >> Mark >> >> 2016-06-01 15:44 GMT+08:00 Alfredo Cardigliano <[email protected] >> <mailto:[email protected]>>: >> Hi Marco >> it could be tcpdump is using the standard usec pcap file format for dumping >> the file, however I connot say more as I guess you forgot to enclose the >> pcap :-) >> >> Alfredo >> >>> On 01 Jun 2016, at 07:15, Marco Kwok <[email protected] >>> <mailto:[email protected]>> wrote: >>> >>> Hello all, >>> >>> My objective is to have nanosecond precision timestamp for packets. >> >> >> <b.pcap>_______________________________________________ >> Ntop-misc mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
