https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7048
Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |darkjames-ws@xxxxxxxxxxxx
Resolution| |INVALID
--- Comment #1 from Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> 2012-04-15 01:49:38 PDT ---
(In reply to comment #0)
> When saving to pcap-ng format, Wireshark writes Interface Statistics blocks
> including start and end timestamps (called isb_starttime and isb_endtime in the
> official file format documentation) to the capture file.
>
> Unfortunately, the values for these high and low timestamps are written in the
> wrong order, with low first instead of high. All other timestamps (for enhanced
> packet blocks etc.) seem to be written correctly.
isb_starttime and isb_endtime are written in host byte order as 64-bit number.
Looking at spec it's valid.
Please note in spec they're not divided (like timestamps in EPB) into high/low
halves.
So you need to read whole 8 bytes, and eventually swap them (if pcapng was
written on BigEndian machine).
Please reopen if you think there's still a bug in wireshark.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.