Guy Harris
changed
bug 11744
| What |
Removed |
Added |
| Component |
Dissection engine (libwireshark)
|
Capture file support (libwiretap)
|
Comment # 2
on bug 11744
from Guy Harris
In the libpcap file reader, the seconds field of the time stamp is unsigned.
Making it signed causes the time to display correctly; libpcap also treats it
as signed, so, as there was no documentation of libpcap format prior to or
concurrent with the release of libpcap, the code counts as documentation.
(I'll update the man page for the format, which I wrote well *after* libpcap
came out, to note that the seconds field of the time stamp should be signed.)
That still leaves unanswered the question of how the *microsecond/nanosecond*
field should be treated; if the seconds field is negative, must the
fraction-of-a-second field be negative as well? I haven't yet found any clear
specification for seconds/fraction-of-a-second absolute time stamps.
You are receiving this mail because:
- You are watching all bug changes.