This is a very good point. The file_stop_time element was introduced
when the change was made to interleaving packets instead of concatenating;
nobody thought to set stop_time based on this new information.
It looks like dump_times() could take advantage of the states array
too, since it seems to do the exact same work as open_files().
Anyway, can you try the attached patch? I'm particularly interested
in whether or not there's a fencepost error (e.g. last packet doesn't
get copied because it is at the stop_time).
Thanks,
Bill
Index: tcpslice.c
===================================================================
RCS file: /tcpdump/master/tcpslice/tcpslice.c,v
retrieving revision 1.27
diff -u -r1.27 tcpslice.c
--- tcpslice.c 30 Oct 2001 17:59:47 -0000 1.27
+++ tcpslice.c 27 Feb 2003 02:41:38 -0000
@@ -123,6 +123,7 @@
struct timeval *first_time, struct timeval *last_time );
struct timeval first_packet_time(char filename[], pcap_t **p_addr);
struct timeval lowest_start_time(struct state *states, int numfiles);
+struct timeval latest_end_time(struct state *states, int numfiles);
void get_next_packet(struct state *s);
struct state *open_files(char *filenames[], int numfiles);
void extract_slice(struct state *states, int numfiles, char *write_file_name,
@@ -241,12 +242,7 @@
stop_time = parse_time(stop_time_string, start_time);
else
- {
- stop_time = start_time;
- stop_time.tv_sec += 86400*3660; /* + 10 years; "forever" */
- stop_time.tv_usec = 0;
- }
-
+ stop_time = latest_end_time(states, numfiles);
if (report_times) {
for (; optind < argc; ++optind)
@@ -516,6 +512,21 @@
++states;
}
return min_time;
+}
+
+/* Of all the files, what is the latest end time. */
+struct timeval
+latest_end_time(struct state *states, int numfiles)
+{
+ struct timeval max_time = states->file_start_time;
+
+ while (numfiles--) {
+ if (sf_timestamp_less_than(&max_time, &states->file_start_time)) {
+ max_time = states->file_start_time;
+ }
+ ++states;
+ }
+ return max_time;
}
/* Get the next record in a file. Deal with end of file.
