Wireshark · Ethereal-dev: Re: [ethereal-dev] Small patch to ease printing timestamps

[Guy Harris <guy@xxxxxxxxxx>]

> Yeah, I could probably just convert them to timevals in my code, but this
> seems handier. One less thing that the dissector has to worry about.

Hmm.

Ethereal may have to deal with some other time stamp formats as well:

	the N different formats that have crept into SMB over time;

	NFS V3 timestamps (which are similar to "struct timeval", only
	they have nanosecond rather than microsecond resolution)

and perhaps some other ones.

(SMB currently doesn't put time stamps into the protocol tree as
filterable fields, it just puts the line in as text, but I don't know if
that'll forever remain the case.)

Is the right way to handle this

	1) to convert to a "standard" format and shove the value, in
	   that format, into the protocol tree (that's how you do it in
	   Microsoft Network Monitor)

or

	2) to add protocol-tree data types for all formats

or

	3) do 1) for some formats and 2) for others?

1) has the advantage that the filtering code and the display code
doesn't have to worry about N different time formats, and the
disadvantage that every field that isn't in that format has to be
converted.

2) has the advantage that dissectors can just put in entries without
converting times, and the disadvantage that the filtering and display
code has to deal with N different time formats.