Wireshark · Wireshark-users: Re: [Wireshark-users] Nano Second Time format

[j.snelders@xxxxxxxxxx]

Hi Ambika,

This is what Wireshark/TShark shows:
$ tshark -r nano_demo.pcap -T fields -e frame.number -e frame.time -e frame.time_delta
-e frame.len -E header=y
frame.number    frame.time      frame.time_delta        frame.len
1       Aug 24, 2009 12:38:47.-11626900 0.000000000     222
2       Aug 24, 2009 12:38:47.-75559000 0.040710000     242
3       Aug 24, 2009 12:38:47.186172000 0.1937279000    212
4       Aug 24, 2009 12:38:47.-14303070 0.1002940296    232
5       Aug 24, 2009 12:38:47.-42778700 0.1002520000    272
6       Aug 24, 2009 12:38:47.563902000 0.991689000     202
7       Aug 24, 2009 12:38:47.157823200 0.1014330000    262
8       Aug 24, 2009 12:38:47.-73430400 0.1982431296    192

I have no idea why Wireshark shows invalid frame times.
Expert Message: Arrival Time: Fractional second out of range (0-1000000000)

Anyone else does?

Best regards
Joan


On Mon, 24 Aug 2009 16:31:22 +0530 Ambika Pr. Tripathy wrote:
>Hi Joan,
>
>Thanks for your replay. I can open the file without any error. But the time
>stamp column shows negative values for some rows. But the nano second and
>second format is perfect in my file used by one of my application .
>
>like my application shows the time as
>24:08:2009::16:08:47.953366470 len:222
>24:08:2009::16:08:47.953407180 len:242
>24:08:2009::16:08:47.955344460 len:212
>24:08:2009::16:08:47.956347400 len:232
>24:08:2009::16:08:47.957349920 len:272
>24:08:2009::16:08:47.958341610 len:202
>24:08:2009::16:08:47.959355940 len:262
>24:08:2009::16:08:47.961338370 len:192
>
>
>where are the wireshark shows time stamp of these files as attached with
>this mail.
>
>
>br,
>Ambika
>
>
>>-- Original Message --
>>Date: Mon, 24 Aug 2009 10:26:25 +0200
>>From: j.snelders@xxxxxxxxxx
>>To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
>>Subject: Re: [Wireshark-users] Nano Second Time format
>>Reply-To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
>>
>>
>>Hi Ambika,
>>
>>What is the problem?
>>Can't you open the capture file?
>>Do you get een error message?
>>
>>Don't you see the nanoseconds?
>>Go to View -> Time Display Format -> Select Nanoseconds: 0.123456789
>>
>>HTH
>>Joan
>>
>>On Mon, 24 Aug 2009 13:04:24 +0530 Ambika Tripathy wrote
>>>
>>>I am facing problem when opening one .pcap file with nano second time
>stamp
>>>in PCAP header using wireshark Version 1.1.3 (SVN Rev 27807). Is it possible
>>>to open it using the same version or there is any other version which
>>>support the format.
>>>
>>>
>>>
>>>Thanks in advance for your response.
>>>
>>>
>>>
>>>Br,
>>>
>>>Ambika Prasad Tripathy
>>>
>>>Call@ +91 94375 47730
>>
>>
>>
>>
>>
>>___________________________________________________________________________
>>Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>>Archives:    http://www.wireshark.org/lists/wireshark-users
>>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
>Ambika Prasad Tripathy
>
>NetHawk Networks India Pvt. Ltd.
>Mob: +91-94375 47730
>mail: ambika.tripathy@xxxxxxxxxxxxxxxx
>web: www.nethawk.fi
>
>
>
>Bijlage: nano_demo.pcap
>

Attachment: nano_demo.pcap
Description: application/pcap