[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 29, 2003, at 1:25 PM, Jesper Peterson wrote:

> Change the timestamp from timeval to timespec and you have covered 
> everything I need (which is of course all that matters).

One question that raises is whether we should make the time stamp for 
*all* packets have nanosecond resolution, which means that packets from 
systems with microsecond-resolution time stamps would have to do an 
extra multiply by 1000 (6 1 bits, so that's 6 shifts-and-adds, or one 
multiply instruction if the machine has one), or make the time stamp 
resolution a per-interface property (per-interface in case, for 
example, you merge two capture files, with different time stamps, into 
one file), which saves a little CPU time when writing the capture, 
*and* lets software reading the file know that you don't get nanosecond 
resolution (not that "microsecond resolution" necessarily really means 
"microsecond resolution", and you also might get some fuzz added if the 
OS's time stamping mechanism guarantees time stamp uniqueness), and 
could generalize to picosecond resolution if we ever have hardware 
where that's sane, but requires more work when reading the capture.