Wireshark-dev: Re: [Wireshark-dev] FILETIME
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 07 Feb 2007 10:28:18 -0800
Gerhard Gappmeier wrote:


is there a simple way to handle windows FILETIME?
Use the routine dissect_nt_64bit_time(), declared in <epan/dissectors/packet-windows-common.h> 


What is FT_ABSOLUTE_TIME and FT_RELATIVE_TIME for?
FT_ABSOLUTE_TIME is for time values that represent a date and time, such as a FILETIME; FT_RELATIVE_TIME is for time values that represent an amount of time since some unspecified point (e.g., "5 minutes from now").
Declare an FT_ABSOLUTE_TIME field and pass its hf_ value as the last argument to dissect_nt_64bit_time().