Ethereal-dev: Re: [Ethereal-dev] Re: some netxray traces off by time factor

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 22 Jul 2005 10:23:20 -0700
Matt Jibson wrote:

Attached is a patch that fixes the problem without breaking other
traces of the same type. I tested with 2-3 traces of each type,
generated from different sources. It appears that if hdr.realtick (or
timeunit) == 3579545 and hdr.timeunit == 0, then "timeunit =
TpS[hdr.timeunit]" should happen.

Noone has replied to this thread yet. Should I mail guy offlist,


No, because
1) he hasn't responded because he's been somewhat busy (and continues to be busy) 

and


since he is probably the appropriate contact?
2) the most appropriate contacts for Windows Sniffer time stamp issues are probably James Fields and Kevin Johnson (see the main and Wiretap AUTHORS file for their addresses), as they're the people who discovered the "realtick" field in the first place 

and


I'm assuming he would have
many more traces to test this against to make sure it doesn't have
unintentional breakage.
3) I have traces, but I don't have a Sniffer, so there's limits on what I can test.