Ethereal-users: [Ethereal-users] timestamp problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Tom.Benton@xxxxxxxxxx
Date: Thu, 22 Jan 2004 17:27:47 -0600

Looking for help with this problem:

i have pcap-formatted file with timestamps
added as %M:%S. format, as follows:


02:22.2429
00000000 c2 00 00 30 f2 cf 01 e0 2f 00 00 01 00 01 5c 22
00000010 21 d2 00 1e 00 00 03 01 03 00 04 01 02 00 00 7d
00000020 ee ca 00 7d ed ad 02 07 02 08 ff fc 40 00 00 01
00000030 c0 80 15 af 08 46 00 af

02:24.0001
00000000 c2 00 00 30 f2 cf 01 e0 2f 00 00 01 00 01 5c 22
00000010 21 d2 00 1e 00 00 03 01 03 00 03 01 02 00 00 7d
00000020 ee ea 00 7d ed cc 02 07 02 08 ff fc 40 00 00 01
00000030 c0 80 43 a9 d6 8a 00 a9

02:26.2432
00000000 c2 00 00 30 f2 cf 01 e0 2f 00 00 01 00 01 5c 22
00000010 21 d2 00 1e 00 00 03 01 03 00 02 01 02 00 00 7d
00000020 ef 0c 00 7d ed ec 02 07 02 08 ff fc 40 00 00 01
00000030 c0 80 9e 1a 82 39 00 1a

02:28.4529
00000000 c2 00 00 30 f2 cf 01 e0 2f 00 00 01 00 01 5c 22
00000010 21 d2 00 1e 00 00 03 01 03 00 06 01 02 00 00 7d
00000020 ef 0f 00 7d ed ee 02 07 02 08 ff fc 40 00 00 01
00000030 c0 80 0e 6a 42 63 00 6a

02:32.2902
00000000 c2 00 00 30 f2 cf 01 e0 2f 00 00 01 00 01 5c 22
00000010 21 d2 00 1e 00 00 03 01 03 00 01 01 02 00 00 7d
00000020 ef 2b 00 7d ee 0c 02 07 02 08 ff fc 40 00 00 01
00000030 c0 80 95 27 55 bd 00 27

I run the file through text2pcap as follows:
 text2pcap -t %M:%S. pcaptime.txt pcaptime.out

with the output being:
Input from: pcaptime.txt
Output to: pcaptime.out
Wrote packet of 15 bytes at 0
Wrote packet of 15 bytes at 15
Wrote packet of 15 bytes at 30
Wrote packet of 15 bytes at 45
Wrote packet of 15 bytes at 60
Read 5 potential packets, wrote 5 packets

However, tethereal has problems with this, the timestamp for the 1st pkt is ok, all others are 18:00
C:/Ethereal> tethereal -ta -r pcaptime.out
  1 00:02:22.242900              ->              DOCSIS MGMT [Short Frame]
  2 18:00:00.000000              ->              DOCSIS MGMT [Short Frame]
  3 18:00:00.000000              ->              DOCSIS MGMT [Short Frame]
  4 18:00:00.000000              ->              DOCSIS MGMT [Short Frame]
  5 18:00:00.000000              ->              DOCSIS MGMT [Short Frame]


Any help as to what i'm doping wrong ?  Please reply directly to me at
tom.benton@xxxxxxxxxx
630 281-3028

Thanks,

Tom