Wireshark · Ethereal-dev: Re: [Ethereal-dev] NetXray / Sniffer Time Codes

[Chris Jepeway <thai-dragon@xxxxxxxxxxxx>]

> > If I just make a wild guess, I'd say it's in the 45th byte after
> > the magic cookie at the file's start.
> 
> After "XCP\0", that is?
Yes.

> That's one of the xxz fields,
Yes, and, just to be clear, I meant xxz[3].

Seems like a red herring, though: simplest of all is
guessing that it's switched off the file's version number,
which is how other timescales for this format are selected.

Sound reasonable?  That is, does it make sense to
say the timeunits for NetXray files with a version
string of "002.001" should be 1193180.0?  If so,
I'll send patches.  If not, please, as they say, advise.

And, while I'm at it, I have a couple coding style questions:

    How do folk feel about declaring functions inline?  It's
    been done in a couple-three places already, but I don't
    see configure checking to see whether the compiler
    supports inline decls.

    Any problem with fleshing out the 64-bit support in
    wtap-int.h by adding pletohll() and htolell() macros?

> (BTW, "next word" is 100,000,000 in the Ethernet capture and 16,000,000
> in the Token Ring capture; if the Ethernet capture was on Fast Ethernet,
> that might be the line speed in bits/second.)
Sensible.  The v2.1 caps I've got from
a Fast Ethernet have the 1e8 value, too.

> Guy
Chris.