Ethereal-dev: Re: [ethereal-dev] 64-bit pcap timestamp problems

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Laurent Deniel <deniel@xxxxxxxxxxx>
Date: Mon, 09 Aug 1999 00:35:38 +0200
John Heffner wrote:
> 
> Redhat 6 (glibc 2.1) uses a time_t (long int) for the struct timeval
> members.
> 
> In redhat 6, libpcap is exacly as you describe below, full of 64-bit bugs.

That's the first OS that I know which uses 64 bits for struct timeval
fields, even Tru64 UNIX/alpha uses 32 bits.
 
> I think the best thing to to is fix libpcap to correctly handle any length
> int, by defining macros SWAP16, SWAP32, and SWAP64, and just do a sizeof
> check to see which one should be used.

No, to correctly handle that problem at libpcap level, a modification
of the file format (and so version) is required. So IMHO this is a bad
idea. It's simpler to force the use of 32 bits timestamps in libpcap.

> As to my previous comment about not using 64-bit values for timestamps so
> that other architechtures could read file generated on 64-bit
> architectures, I was completely wrong.  This stuf is full of
> arch-dependent stuff anyway.

Which ones ? libpcap file format is quite portable.

--
Laurent DENIEL        | E-mail: deniel@xxxxxxxxxxx
Paris, FRANCE         |         laurent.deniel@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
                      | WWW   : http://www.worldnet.fr/~deniel
    All above opinions are personal, unless stated otherwise.