Wireshark-bugs: [Wireshark-bugs] [Bug 7457] PCAPNG: timestamps get changed when tshark reads and
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 9 Jul 2012 20:57:57 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7457

--- Comment #4 from holychan@xxxxxxxxx 2012-07-09 20:57:57 PDT ---
In fact, if the timestamp is down to nanosecond level (see attached
icmp2.ntar), the behavior is more strange. 
It seems that there is just enough space for storing a timestamp of 6 decimal
places from a pcapng file. To satisfy the nanosecond requirement in the output
file, the decimal point is forced to move to the front.

$ tshark -r icmp2.ntar -e frame.time_epoch -Tfields
22425.352221737
22425.353265860
22426.353147820
22426.354145140
22427.353181790
22427.355758442
22428.353161245
22428.354134781

$ tshark -r icmp2.ntar -w tmp.pcapng

$ tshark -r tmp.pcapng -e frame.time_epoch -Tfields
22.425352221
22.425353265
22.426353147
22.426354145
22.427353181
22.427355758
22.428353161
22.428354134

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.