Ethereal-users: [Ethereal-users] The Enigma of CAP-file header TIMESTAMPS ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Markku Tiuri" <markku.tiuri@xxxxxxxxxxx>
Date: Mon, 17 Jan 2005 10:25:18 +0200
Title: Message
This is an example af an XCP header of a Capture file
 58 43 50 00 30 30 32 2E 30 30 32 00 FB 8E 4E 41
 F6 EB 00 00 BE FF EF 03 80 00 00 00 DE AF 62 00
 0F 76 61 00 00 00 00 00 DE AF 62 00 00 00 00 00
 02 00 00 00 78 A2 24 CA A7 01 00 00 00 CA 9A 3B
 00 00 00 00 01 00 00 00 14 00 04 00 99 9E 36 00
 00 00 00 00 05 00 01 00 00 00 00 00 00 00 00 00
 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 00 00 00 00 00 00 00 00 00 00 00 00 01 01 E0 E3
 
The field names might go like this..............................
 header | version | start time (low)
 time (high?) | something (number of frames) | start offset | end offset
 network information00 00
 (02) time unit | time low - time high - lines speed
some info 64 bytes
 
We do not know how the start time is calculated  - can anyone HELP us ?
We can calculate the times for the following frames in the CAP file if we
somehow can deduct the actual start time to which the frame times all are related to

Markku Tiuri
Product and Marketing Manager

NSF Telecom Ab                     
tel. +358 40 830 7807

markku.tiuri@xxxxxxxxxxx

http://www.nsftele.com
http://www.nsftelecom.fi
Continental office
Junailijankuja 4 B, FI-02430 Masala
tel. +358 9 250 45 11, fax. +358 9 250 45 12



 
BEGIN:VCARD
VERSION:2.1
N:Tiuri;Markku
FN:Markku Tiuri (NSFTELECOM)
ORG:NSF Telecom Ab
TITLE:Product and Marketing Manager
TEL;WORK;VOICE:+358 9 250 45 11
TEL;WORK;VOICE:+358 04 830 7807
TEL;HOME;VOICE:+358 9 8035512
TEL;CELL;VOICE:+358 40 830 78 07
TEL;WORK;FAX:+358 (9) 2504512
ADR;WORK:;;Junailijankuja 4B;Masala;;02430;Finland
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Junailijankuja 4B=0D=0AMasala 02430=0D=0AFinland
URL;WORK:http://www.nsftele.com
EMAIL;PREF;INTERNET:markku.tiuri@xxxxxxxxxxx
REV:20040531T082515Z
END:VCARD