Hi, Today I received a tcpdump file from a client with timestamps that did not correspond to the system clock. If I remember correctly, tcpdump does not store complete timestamps but only a delta compared to the first timestamp. I guess tcpdump does not read the system clock every time, but has its own mechanisms. My question is, how does tcpdump calculate its timestamps?
Thank you, Andrej - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
