Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 7048] pcap-ng Interface Statistics block writes wrong timestamps

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7048

Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |darkjames-ws@xxxxxxxxxxxx
         Resolution|                            |INVALID

--- Comment #1 from Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> 2012-04-15 01:49:38 PDT ---
(In reply to comment #0)
> When saving to pcap-ng format, Wireshark writes Interface Statistics blocks
> including start and end timestamps (called isb_starttime and isb_endtime in the
> official file format documentation) to the capture file. 
> 
> Unfortunately, the values for these high and low timestamps are written in the
> wrong order, with low first instead of high. All other timestamps (for enhanced
> packet blocks etc.) seem to be written correctly.

isb_starttime and isb_endtime are written in host byte order as 64-bit number.
Looking at spec it's valid.
Please note in spec they're not divided (like timestamps in EPB) into high/low
halves.

So you need to read whole 8 bytes, and eventually swap them (if pcapng was
written on BigEndian machine).

Please reopen if you think there's still a bug in wireshark.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.