Wireshark · Ethereal-dev: Re: [Ethereal-dev] How to read/import and display capture files with 1ns timestamp resolution?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Guy Harris wrote:

> Dumas Hwang of Navtel Communications asked for, and got, a magic 
> number for a format that includes nanosecond time stamps; in his 
> tcpdump-workers mail, he mentioned updating Ethereal to handle this, 
> but I don't know what the status of that work is.
>
> Dumas, is that new format being used?  If so, is there any difference 
> between it and the regular format other than the time stamp being 
> seconds/nanoseconds rather than seconds/microseconds (e.g., extra 
> fields in the file header or the per-packet header, or non-standard 
> DLT_ values that collide with assigned DLT_ values)?  Ulf might want 
> to use that format as well.
Yes, I had exactly the same thing in mind of simply changing the meaning 
of the usec field as there are enough bits left for this. Why create 
another format if something similar already exists.

As I've digged a bit around in the Ethereal code, wiretap seems only to 
work with us resolution for now, so there seems to be left some work to 
support this.

Regards, ULFL