Ethereal-users: Re: [Ethereal-users] Etherreal 0.10.10 problem reading Sniffer logs timestamps

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 07 Apr 2005 12:54:45 -0700
phil.5.thomas@xxxxxx wrote:

I have NAI Sniffer v4.70.04 running on NT4 on a FlexPAC system. When I import the traces into Etherreal v0.10.10 (running on the same machine), it gets the timestamps all messed up. A 3min 25second capture shows up as being 5377seconds long. This is the same sort of factor for my other traces. I don't want to attach the file as its quite large but if someone can point me in the right direction that would be great. Alternatively if the dev team are aware of this problem (according to the wiki this was going to be fixed in 0.10.09?)

The handling of time stamps was *improved* in 0.10.9.

I wouldn't say "fixed", however, as all the improvement came from reverse engineering, so that just means it's fixed on the files used for the reverse engineering.

I'll let the people who did the reverse engineering in question (they figured out that, in newer versions of the Sniffer software, they store not only an old-style index into a table of time stamp units, but the raw value of the time stamp unit itself, in the file header) respond, if they've found any more information. (My *suspicion* is that at least *some* of the problems *might* be due to the fact that, before the fix to use the raw time stamp value, we'd tweaked some time stamp values in the table to fix some problems with files that had the raw time stamp value in the header, so that the tweaked value isn't correct for files that *don't* have the raw time stamp value and the tweak isn't necessary for files that do. I don't have the files - or the Sniffer - with which to test that hypothesis.)