Wireshark · Ethereal-dev: Re: [ethereal-dev] 64-bit pcap timestamp problems

[John Heffner <heffner@xxxxxxx>]

On Sun, 8 Aug 1999, Guy Harris wrote:

> > The original change was in the Linux 2.2.x kernel, I beleive (possibly in
> > the 2.1.x kernel).  I'm not sure why they did this.
> 
> To avoid the Y2.038K bug?

OK.  Makes sense.

> > This makes sense; however, every application that uses libpcap must be
> > careful to define its own timeval structure that has 32-bit ints, instead
> > of using the one defined in the system headers.
> 
> ...or "libpcap" needs to be changed not to use "struct timeval" in
> "pcap_pkthdr", and to use instead, say, "bpf_u_int32 ts_sec" and
> "bpf_u_int32 ts_usec", and the applications need to refer to "ts_sec"
> and "ts_usec" rather than "ts.tv_sec" and "ts.tv_usec".

This brings up a problem related to the one above: if this is hardwired to
32 bits, the file format will lock everyone in to using 32 bit time
values while everything will (hopefully) be migrating away from them.

  -John