Ethereal-users: Re: [Ethereal-users] >> Lastest Network General Sniffer format Displaying Wrong

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 02 Jan 2005 20:47:01 -0800
Guy Harris wrote:

The time stamps in Windows Sniffer captures are not always interpreted
correctly by Ethereal; unfortunately, we have not yet been able to
reverse-engineer the file sufficiently to figure out what data in the file
specifies how to compute the time stamps correctly.

James Fields and Kevin Johnson have discovered that there's a field in the file header of *some* captures that contains the units of the time stamp (in other captures, it's zero). I've checked in their patch to fetch the time stamp units from there; the next release should have that change (and possibly other changes to the NetXRay/Windows Sniffer file reading code as well).

That fix might or might not fix the problem reported.