Wireshark-users: Re: [Wireshark-users] Nano Second Time format
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Ambika Pr. Tripathy" <tripaam@xxxxxxxxxx>
Date: Mon, 24 Aug 2009 22:44:24 +0530
I got this capture from my accelerator card, that i am using for monitoring
data capture which supports nano second time stamp. but the problem is here
when i used winpcap lib functions to parse the packets it is showing perfect
time stamp as per expected in the log i have attached below. and the nano
second time and second time is perfectly calculated by card that i watch
from the capture file using the winpcap api.

As per my knowledge, wireshark is modifying the time to system time, and
then put the fist packet arrival time t0 0.000000000 in display and then
so on.

is the problem is in wireshark or in my capture file???

the system i am using is ubutnu9.04, 64bit server.

br,
Ambika


>-- Original Message --
>Date: Mon, 24 Aug 2009 07:11:50 -0700
>From: M Holt <m.iostreams@xxxxxxxxx>
>To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
>Subject: Re: [Wireshark-users] Nano Second Time format
>Reply-To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
>
>
>Doing a google search for "Arrival Time: Fractional second -1430307000
is
>invalid, the valid range is 0-1000000000".
>It looks like it might be a bug in libpcap - where did you get the capture?
>
>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530667
>
>Not sure if that helps...
>
>On Mon, Aug 24, 2009 at 5:36 AM, <j.snelders@xxxxxxxxxx> wrote:
>
>> Hi Ambika,
>>
>> This is what Wireshark/TShark shows:
>> $ tshark -r nano_demo.pcap -T fields -e frame.number -e frame.time -e
>> frame.time_delta
>> -e frame.len -E header=y
>> frame.number    frame.time      frame.time_delta        frame.len
>> 1       Aug 24, 2009 12:38:47.-11626900 0.000000000     222
>> 2       Aug 24, 2009 12:38:47.-75559000 0.040710000     242
>> 3       Aug 24, 2009 12:38:47.186172000 0.1937279000    212
>> 4       Aug 24, 2009 12:38:47.-14303070 0.1002940296    232
>> 5       Aug 24, 2009 12:38:47.-42778700 0.1002520000    272
>> 6       Aug 24, 2009 12:38:47.563902000 0.991689000     202
>> 7       Aug 24, 2009 12:38:47.157823200 0.1014330000    262
>> 8       Aug 24, 2009 12:38:47.-73430400 0.1982431296    192
>>
>> I have no idea why Wireshark shows invalid frame times.
>> Expert Message: Arrival Time: Fractional second out of range (0-1000000000)
>>
>> Anyone else does?
>>
>> Best regards
>> Joan
>>
>>
>> On Mon, 24 Aug 2009 16:31:22 +0530 Ambika Pr. Tripathy wrote:
>> >Hi Joan,
>> >
>> >Thanks for your replay. I can open the file without any error. But the
>> time
>> >stamp column shows negative values for some rows. But the nano second
>and
>> >second format is perfect in my file used by one of my application .
>> >
>> >like my application shows the time as
>> >24:08:2009::16:08:47.953366470 len:222
>> >24:08:2009::16:08:47.953407180 len:242
>> >24:08:2009::16:08:47.955344460 len:212
>> >24:08:2009::16:08:47.956347400 len:232
>> >24:08:2009::16:08:47.957349920 len:272
>> >24:08:2009::16:08:47.958341610 len:202
>> >24:08:2009::16:08:47.959355940 len:262
>> >24:08:2009::16:08:47.961338370 len:192
>> >
>> >
>> >where are the wireshark shows time stamp of these files as attached
with
>> >this mail.
>> >
>> >
>> >br,
>> >Ambika
>> >
>> >
>> >>-- Original Message --
>> >>Date: Mon, 24 Aug 2009 10:26:25 +0200
>> >>From: j.snelders@xxxxxxxxxx
>> >>To: "Community support list for Wireshark" <
>> wireshark-users@xxxxxxxxxxxxx>
>> >>Subject: Re: [Wireshark-users] Nano Second Time format
>> >>Reply-To: Community support list for Wireshark <
>> wireshark-users@xxxxxxxxxxxxx>
>> >>
>> >>
>> >>Hi Ambika,
>> >>
>> >>What is the problem?
>> >>Can't you open the capture file?
>> >>Do you get een error message?
>> >>
>> >>Don't you see the nanoseconds?
>> >>Go to View -> Time Display Format -> Select Nanoseconds: 0.123456789
>> >>
>> >>HTH
>> >>Joan
>> >>
>> >>On Mon, 24 Aug 2009 13:04:24 +0530 Ambika Tripathy wrote
>> >>>
>> >>>I am facing problem when opening one .pcap file with nano second time
>> >stamp
>> >>>in PCAP header using wireshark Version 1.1.3 (SVN Rev 27807). Is it
>> possible
>> >>>to open it using the same version or there is any other version which
>> >>>support the format.
>> >>>
>> >>>
>> >>>
>> >>>Thanks in advance for your response.
>> >>>
>> >>>
>> >>>
>> >>>Br,
>> >>>
>> >>>Ambika Prasad Tripathy
>> >>>
>> >>>Call@ +91 94375 47730
>> >>
>> >>
>> >>
>> >>
>> >>
>>
>> >>___________________________________________________________________________
>> >>Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx
>> >
>> >>Archives:    http://www.wireshark.org/lists/wireshark-users
>> >>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> >>             mailto:wireshark-users-request@xxxxxxxxxxxxx
>> ?subject=unsubscribe
>> >
>> >Ambika Prasad Tripathy
>> >
>> >NetHawk Networks India Pvt. Ltd.
>> >Mob: +91-94375 47730
>> >mail: ambika.tripathy@xxxxxxxxxxxxxxxx
>> >web: www.nethawk.fi
>> >
>> >
>> >
>> >Bijlage: nano_demo.pcap
>> >
>>
>>
>>
>>
>>
>>
>> ___________________________________________________________________________
>> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>> Archives:    http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>             mailto:wireshark-users-request@xxxxxxxxxxxxx
>> ?subject=unsubscribe
>>
>___________________________________________________________________________
>Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>Archives:    http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

Ambika Prasad Tripathy

NetHawk Networks India Pvt. Ltd.
Mob: +91-94375 47730
mail: ambika.tripathy@xxxxxxxxxxxxxxxx
web: www.nethawk.fi