http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=33607
User: guy
Date: 2010/07/21 09:26 AM
Log:
According to mail from Paul Long at Microsoft, in the 1.x NetMon file
format, the time offset from the start of the capture always had a
positive value, so it's an unsigned value. (In newer versions of NetMon
3.x, the capture can start before the "capture start" time stamp is set,
so packets can have a *negative* offset from the capture start time
stamp. Those captures are in the 2.x file format.)
Directory: /trunk/wiretap/
Changes Path Action
+7 -1 netmon.c Modified