diff --git a/doc/README.dissector b/doc/README.dissector index 8232b28dd5..63fa648f75 100644 --- a/doc/README.dissector +++ b/doc/README.dissector @@ -1582,6 +1582,9 @@ encodings that are currently supported are: ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds since the UN*X epoch. + ENC_TIME_USECS - 8 bytes, representing a value in microseconds since + the UN*X epoch. + ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds since the UN*X epoch. @@ -1595,7 +1598,7 @@ encodings that are currently supported are: ENC_TIME_MSEC_NTP - 4-8 bytes, representing a count of milliseconds since the NTP epoch. - ENC_MIP6 - 8 bytes; the first 48 bits are seconds since the UN*X epoch + ENC_TIME_MIP6 - 8 bytes; the first 48 bits are seconds since the UN*X epoch and the remaining 16 bits indicate the number of 1/65536's of a second since that second. @@ -1619,6 +1622,8 @@ encodings that are currently supported are: ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds. + ENC_TIME_USECS - 8 bytes, representing a value in microseconds. + ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds. For other types, there is no support for proto_tree_add_item(). diff --git a/epan/proto.c b/epan/proto.c index 6b6f626656..4ff755aa62 100644 --- a/epan/proto.c +++ b/epan/proto.c @@ -2265,6 +2265,26 @@ get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start, } break; + case ENC_TIME_USECS|ENC_BIG_ENDIAN: + case ENC_TIME_USECS|ENC_LITTLE_ENDIAN: + /* + * Microseconds, 1 to 8 bytes. + * For absolute times, it's microseconds since the + * UN*X epoch. + */ + if (length >= 1 && length <= 8) { + guint64 usecs; + + usecs = get_uint64_value(tree, tvb, start, length, encoding); + time_stamp->secs = (time_t)(usecs / 1000000); + time_stamp->nsecs = (int)(usecs % 1000000)*1000; + } else { + time_stamp->secs = 0; + time_stamp->nsecs = 0; + report_type_length_mismatch(tree, "a time-in-microseconds time stamp", length, (length < 4)); + } + break; + case ENC_TIME_NSECS|ENC_BIG_ENDIAN: case ENC_TIME_NSECS|ENC_LITTLE_ENDIAN: /* diff --git a/epan/proto.h b/epan/proto.h index 862dfe27b6..fe28d8e463 100644 --- a/epan/proto.h +++ b/epan/proto.h @@ -564,6 +564,12 @@ void proto_report_dissector_bug(const char *format, ...) * ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds. * If the time is absolute, it's milliseconds since the UN*X epoch. * + * ENC_TIME_USECS - 8 bytes, representing a value in microseconds. + * If the time is absolute, it's microseconds since the UN*X epoch. + * + * ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds. + * If the time is absolute, it's nanoseconds since the UN*X epoch. + * * ENC_TIME_SECS_NTP - 4 bytes, representing a count of seconds since * the NTP epoch. * @@ -574,16 +580,13 @@ void proto_report_dissector_bug(const char *format, ...) * ENC_TIME_MSEC_NTP - 4-8 bytes, representing a count of milliseconds since * the NTP epoch. * - * ENC_MIP6 - 8 bytes; the first 48 bits are seconds since the UN*X epoch + * ENC_TIME_MIP6 - 8 bytes; the first 48 bits are seconds since the UN*X epoch * and the remaining 16 bits indicate the number of 1/65536's of a second * since that second. * * ENC_TIME_CLASSIC_MAC_OS_SECS - 4-8 bytes, representing a count of seconds * since January 1, 1904, 00:00:00 UTC. * - * ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds. - * If the time is absolute, it's nanoseconds since the UN*X epoch. - * * The backwards-compatibility names are defined as hex numbers so that * the script to generate init.lua will add them as global variables, * along with the new names. @@ -604,6 +607,7 @@ void proto_report_dissector_bug(const char *format, ...) #define ENC_TIME_MIP6 0x00000024 #define ENC_TIME_CLASSIC_MAC_OS_SECS 0x00000026 #define ENC_TIME_NSECS 0x00000028 +#define ENC_TIME_USECS 0x00000030 /* * For cases where a string encoding contains a timestamp, use one