Ethereal-dev: Re: [Ethereal-dev] Re: some netxray traces off by time factor

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 22 Jul 2005 11:44:38 -0700
Matt Jibson wrote:

The working file:
hdr.timeunit = 2
hdr.realtick = 0x001234de = 1193182
It's timeunit thus ends up as 1193182, since hdr.realtick != 0.

The broken  file:
hdr.timeunit = 0
hdr.realtick = 0x369e99 = 3579545
It's timeunit is 3579545, since hdr.realtick != 0.
This broken file is fixed by: timeunit /= 3.579545, which yields a
timeunit of 1000000. This corresponds to TpS[0], or TpS[hdr.timeunit].
This is important around line 420 of wiretap/netxray.c.

Are there any files with hdr.timeunit = 0 and a non-zero hdr.realtick where the time stamp tick is the value from hdr.realtick, rather than 1 microsecond? (This question is asked of the audience at large, including the guys who discovered hdr.realtick in the first place.)

I.e., does hdr.timeunit mean the time stamp units are 1 microsecond regardless of what's in hdr.realtick, with hdr.realtick used only for hdr.timeunit = 2 and *maybe* hdr.timeunit = 1?