From Paolo Abeni:
The attached patch fix an off by one in current usb sniffing code. It also substitute the kernel-provided timestamp with gettimeofday. The kernel provided timestamp use 32 bits to represent a struct timeval (8 bits for tv_sec and 24 for tv_usec), so it's content is quite misleading.
This commit is contained in:
parent
455aff8ba9
commit
24f60579bc
|
@ -241,8 +241,15 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
|
|||
uhdr->endpoint_number = htonl(ep_num);
|
||||
uhdr->device_address = htonl(dev_addr);
|
||||
string += cnt;
|
||||
pkth.ts.tv_sec = timestamp / 1000000;
|
||||
pkth.ts.tv_usec = timestamp % 1000000;
|
||||
|
||||
/* don't use usbmon provided timestamp, since it have low precision*/
|
||||
if (gettimeofday(&pkth.ts, NULL) < 0)
|
||||
{
|
||||
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
|
||||
"Can't get timestamp for message '%s' %d:%s",
|
||||
string, errno, strerror(errno));
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* parse endpoint information */
|
||||
if (pipeid1 == 'C')
|
||||
|
@ -353,6 +360,9 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
|
|||
if (urb_tag != '=')
|
||||
goto got;
|
||||
|
||||
/* skip urb tag and following space */
|
||||
string += 3;
|
||||
|
||||
/* read all urb data; if urb length is greater then the usbmon internal
|
||||
* buffer length used by the kernel to spool the URB, we get only
|
||||
* a partial information.
|
||||
|
|
Reference in New Issue