On 2016/04/18 20:40, Martin Natano wrote: > I have bumping bpf_timeval to 64bit on my todo list too. However I'm not > sure what the best course of action is there. Replacing bpf_timeval with > timeval might be problematic, because that means bpf wouldn't be binary > stable across platforms. (tv_usec in struct timeval is a long int.)
The only place that needs to be fixed size is in dump files as my diff handles. Everyone else uses timeval. Doing anything else is a big problem for ports that uses pcap and cares about timing (the nmap port is using a separate copy of libpcap because of this).
