osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

pcap-common: set the time stamp precision correctly for LINKTYPE_ERF. 

LINKTYPE_ERF pcap files are really ERF files inside a thin pcap wrapper
(don't even ask what a pcapng file with some or all interfaces being
LINKTYPE_ERF is...), so the time stamp comes from the ERF record, not
from the pcap packet header or pcapng block header.

The time stamp reslution for the record should reflect that, so set it
to WTAP_TSPREC_NSEC (ERF time stamps are fractional-power-of-2, not
fractional-power-of-10, so that's the best we can do).


(cherry picked from commit 39315979c6)
This commit is contained in:
Guy Harris 2021-06-18 17:43:36 -07:00
parent 755a470644
commit 1afaa65fdd
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
wiretap/pcap-common.c
View File

@ -1437,6 +1437,15 @@ pcap_read_erf_pseudoheader(FILE_T fh, wtap_rec *rec,
rec->ts.nsecs -= 1000000000;
rec->ts.secs += 1;
}
/*
* This time stamp came from the ERF header, not from the
* pcap packet header or pcapng block header, so its
* precision is that of ERF time stamps, not the pcap
* file's time stamp or the pcapng interface's time
* stamp.
*/
rec->tsprec = WTAP_TSPREC_NSEC;
}
/*