Wireshark · Wireshark-users: Re: [Wireshark-users] Incorrect TimeStamp

[Ulf Lamping <ulf.lamping@xxxxxx>]

Koolrans wrote:
> Hi,
>
> I am outputing the captured data to pcap file using the defined
> specifications. For some reason I am getting negative value for the
> time stamp. I tried 2 other decoders which display this correctly. I
> have attached the capture file. I have verified (using Hex Editor)
> that the data written to file is what I expect. Please ignore the mac
> and ip values as I am only concentrating to learn to write a pcap
> file. Can someone notice anything wrong I might be doing.
As noted in http://wiki.wireshark.org/Development/LibpcapFileFormat

ts_usec: the microseconds when this packet was captured, as an offset to 
/ts_sec/. /!\ Beware: this value shouldn't reach 1 second (1 000 000), 
in this case /ts_sec/ must be increased instead!


Regards, ULFL