Wireshark mailing list archives
Re: Writing PcapNG with nanosecond timestamps
From: Guy Harris <guy () alum mit edu>
Date: Mon, 3 Dec 2012 11:37:47 -0800
On Dec 3, 2012, at 5:37 AM, Erik Hjelmvik <erik.hjelmvik () gmail com> wrote:
The Pcap-NG file format has support for using nano-second resolution timestamps, and from what I understand Wireshark uses nanoseconds internally. However, I'm not able to get Wireshark or dumpcap to write pcapng files with nanosecond resolution. All I get is the default microsecond timestamps. Is there some switch or setting in Wireshark or dumpcap that I can use in order to enable nanosecond timestamps in the output pcapng file?
Given that dumpcap uses libpcap/WinPcap to do capturing, and libpcap/WinPcap deliver only microsecond-resolution time stamps, no, there's no such setting. The pcap API is explicitly specified to deliver seconds-and-microseconds, so an API would have to be added to it to request higher-resolution time stamps. ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Writing PcapNG with nanosecond timestamps Erik Hjelmvik (Dec 03)
- Re: Writing PcapNG with nanosecond timestamps Guy Harris (Dec 03)