Re: Fwd: Re: Printing nanosecond timestamp information in raw output

[Guy Harris <guy () alum mit edu>]

On Dec 28, 2012, at 3:53 PM, Guy Harris <guy () alum mit edu> wrote:

> I would suggest, instead, that you:
>
>       modify *libpcap*, so that it returns nanosecond-resolution time stamps;

I would also suggest that you modify it to write out pcap files with a different magic number, so that, if you ever run 
tcpdump with the -w flag, the files are flagged as having nanosecond-resolution time stamps.

In the libpcap function sf_write_header(), have it write out NSEC_TCPDUMP_MAGIC rather than TCPDUMP_MAGIC.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers