diff --git a/acinclude.m4 b/acinclude.m4 index fec5fc8a45..4b89b35dd3 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -627,7 +627,7 @@ install a newer version of the header file.]) AC_CHECK_FUNCS(pcap_datalink_val_to_description) AC_CHECK_FUNCS(pcap_list_datalinks pcap_set_datalink pcap_lib_version) AC_CHECK_FUNCS(pcap_get_selectable_fd pcap_free_datalinks) - AC_CHECK_FUNCS(pcap_create bpf_image) + AC_CHECK_FUNCS(pcap_create bpf_image pcap_set_tstamp_precision) fi LIBS="$ac_save_LIBS" ]) diff --git a/cmake/modules/FindPCAP.cmake b/cmake/modules/FindPCAP.cmake index 268b3e1a22..9e29881618 100644 --- a/cmake/modules/FindPCAP.cmake +++ b/cmake/modules/FindPCAP.cmake @@ -77,6 +77,7 @@ check_function_exists( "pcap_list_datalinks" HAVE_PCAP_LIST_DATALINKS ) check_function_exists( "pcap_set_datalink" HAVE_PCAP_SET_DATALINK ) check_function_exists( "bpf_image" HAVE_BPF_IMAGE ) check_function_exists( "pcap_setsampling" HAVE_PCAP_SETSAMPLING ) +check_function_exists( "pcap_set_tstamp_precision" HAVE_PCAP_SET_TSTAMP_PRECISION ) # Remote pcap checks check_function_exists( "pcap_open" HAVE_PCAP_OPEN ) check_function_exists( "pcap_findalldevs_ex" H_FINDALLDEVS_EX ) diff --git a/cmakeconfig.h.in b/cmakeconfig.h.in index 5265de4ca2..fe7b916be1 100644 --- a/cmakeconfig.h.in +++ b/cmakeconfig.h.in @@ -230,9 +230,12 @@ /* Define to 1 if you have the `pcap_set_datalink' function. */ #cmakedefine HAVE_PCAP_SET_DATALINK 1 -/* Define to 1 if you have the `pcap_setsampling" function. */ +/* Define to 1 if you have the `pcap_setsampling' function. */ #cmakedefine HAVE_PCAP_SETSAMPLING 1 +/* Define to 1 if you have the `pcap_set_tstamp_precision' function. */ +#cmakedefine HAVE_PCAP_SET_TSTAMP_PRECISION 1 + /* Define to 1 if you have the header file. */ #cmakedefine HAVE_PORTAUDIO_H 1 diff --git a/dumpcap.c b/dumpcap.c index 0ae6bac38f..809ce6cf02 100644 --- a/dumpcap.c +++ b/dumpcap.c @@ -714,6 +714,31 @@ open_capture_device(interface_options *interface_opts, pcap_set_promisc(pcap_h, interface_opts->promisc_mode); pcap_set_timeout(pcap_h, CAP_READ_TIMEOUT); +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + /* + * If we're writing pcap-ng files, try to enable + * nanosecond-resolution capture; any code that + * can read pcap-ng files must be able to handle + * nanosecond-resolution time stamps. + * + * If we're writing pcap files, don't try to enable + * nanosecond-resolution capture, as not all code + * that reads pcap files recognizes the nanosecond- + * resolution pcap file magic number. + */ + if (capture_opts->use_pcapng) { + /* + * The only errors this is documenting as returning + * are PCAP_ERROR_TSTAMP_PRECISION_NOTSUP, which just + * means we can't do nanosecond precision on this adapter, + * in which case we just live with whatever resolution + * we get by default, and PCAP_ERROR_ACTIVATED, which + * can't happen as we haven't activated the pcap_t yet. + */ + pcap_set_tstamp_precision(pcap_h, PCAP_TSTAMP_PRECISION_NANO); + } +#endif + g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "buffersize %d.", interface_opts->buffer_size); if (interface_opts->buffer_size != 0) { @@ -2638,6 +2663,12 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld, if (pcap_opts->pcap_h != NULL) { /* we've opened "iface" as a network device */ + +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + /* Find out if we're getting nanosecond-precision time stamps */ + pcap_opts->ts_nsec = pcap_get_tstamp_precision(pcap_opts->pcap_h) == PCAP_TSTAMP_PRECISION_NANO; +#endif + #ifdef _WIN32 /* try to set the capture buffer size */ if (interface_opts.buffer_size > 1 &&