[Guy Harris <guy@xxxxxxxxxx>]

> It just so happens that <sys/time.h> contains a macro, «timersub» that
> is *supposed* to compute the difference between two «struct timval»s.
> Well, sometimes it doesn't work, and adds an extra second. It's on my
> todo list to dive in and find out why, and/or replace it, or fix it
> and send a patch back for GNU libc.

...which won't help if the same bug exists in operating systems that
*don't* use GNU libc.

Furthermore, a search of "/usr/include" and subdirectories under it on
Solaris 2.6 reveals no sign of any "timersub()" macro, so, unless you
don't intend to use your dissector other than on certain OSes (and thus
don't intend to have your dissector be part of the official Ethereal
source), you shouldn't be using "timersub()" at all.

See, instead, the routine "compute_timestamp_diff()" in Ethereal's
"util.c", which, unlike the "timersub()" on a Red Hat system here,
doesn't assume that the difference between the time stamps is always
going to be positive.

It doesn't take "struct timeval"s or pointers thereto as arguments, so
if you're using "struct timeval"s you'd have to extract the "tv_sec" and
"tv_usec" values into "guint32" variables and pass them into
"compute_timestamp_diff()".