Hi!
Can I add this structure in pcap.h and get a new magic number so
that we can support nanosecond resolution?
/* "libpcap" record header. */
struct pcaprec_hdr {
guint32 ts_sec; /* timestamp seconds */
guint32 ts_usec; /* timestamp microseconds */
guint32 incl_len; /* number of octets of packet saved in
file */
guint32 orig_len; /* actual length of packet */
};
/* libpcap header for version used by Navtel */
struct pcaprec_navtel_hdr {
struct pcaprec_hdr hdr; /* the regular header */
guint32 ts_nsec; /* timestamp nanoseconds */
};
Regards,
Dumas Hwang
> Should I add a new struct and request a new magic number? I would
> think many people
> need nanosecond resolution (if not picosecond).
That's probably a reasonable short-term answer, if you need this soon.
I wouldn't do much of anything more in the new format, though, because
the right long term answer is
http://www.tcpdump.org/pcap/pcap.html
which supports a number of new things, including the ability to specify
the accuracy of time stamps. It'd be nice to add the ability to *read*
that format to libpcap 0.9, but still have it write the old format, so
that when we add the ability to *write* that format, there will be at
least some versions of libpcap that will be able to handle new-format
captures with only one interface.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
