Ethereal-dev: Re: [Ethereal-dev] netxray.c - patches
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
Bill Meier wrote:
Based upon examination of certain captures using both windows
sniffer and ethereal, I'm offering some patches of netxray.c with respect
to the correct determination of 'time' for frames of a capture.
James Fields and Kevin Johnson, as per their recent netxray.c patch,
might have been the ones to finally find the right way to determine the
time stamp units for many Windows Sniffer captures - apparently, there's
a field in the file header of many captures that gives the time units
(in units of timer ticks per second).
I've just checked in a change to use that value for version 2 files - if
the value is non-zero; if it's zero, as is the case in some version 2
files, we use the timeunit value as an index into the TpS array, as we
were doing before.
See whether that fixes all the problems you've seen, or if there are
still problems with some captures - and whether they're time offset
problems (i.e., if all time stamps are wrong by the same amount) or time
scale problems (i.e., they're all wrong by a different amount, with the
difference between that amount for packet N and packet N+1 being
constant), or if there's some other type of problem.
