Koolrans wrote:
Hi,
I am outputing the captured data to pcap file using the defined
specifications. For some reason I am getting negative value for the
time stamp. I tried 2 other decoders which display this correctly. I
have attached the capture file. I have verified (using Hex Editor)
that the data written to file is what I expect. Please ignore the mac
and ip values as I am only concentrating to learn to write a pcap
file. Can someone notice anything wrong I might be doing.
As noted in http://wiki.wireshark.org/Development/LibpcapFileFormat
ts_usec: the microseconds when this packet was captured, as an offset to
/ts_sec/. /!\ Beware: this value shouldn't reach 1 second (1 000 000),
in this case /ts_sec/ must be increased instead!
Regards, ULFL