From 39315979c638b916d76a9dbf8c7ffb089721f01a Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Fri, 18 Jun 2021 17:43:36 -0700 Subject: [PATCH] pcap-common: set the time stamp precision correctly for LINKTYPE_ERF. LINKTYPE_ERF pcap files are really ERF files inside a thin pcap wrapper (don't even ask what a pcapng file with some or all interfaces being LINKTYPE_ERF is...), so the time stamp comes from the ERF record, not from the pcap packet header or pcapng block header. The time stamp reslution for the record should reflect that, so set it to WTAP_TSPREC_NSEC (ERF time stamps are fractional-power-of-2, not fractional-power-of-10, so that's the best we can do). --- wiretap/pcap-common.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/wiretap/pcap-common.c b/wiretap/pcap-common.c index 6b1136ac4b..3058fe0dca 100644 --- a/wiretap/pcap-common.c +++ b/wiretap/pcap-common.c @@ -1441,6 +1441,15 @@ pcap_read_erf_pseudoheader(FILE_T fh, wtap_rec *rec, rec->ts.nsecs -= 1000000000; rec->ts.secs += 1; } + + /* + * This time stamp came from the ERF header, not from the + * pcap packet header or pcapng block header, so its + * precision is that of ERF time stamps, not the pcap + * file's time stamp or the pcapng interface's time + * stamp. + */ + rec->tsprec = WTAP_TSPREC_NSEC; } /*