Wireshark · Ethereal-users: RE: [Ethereal-users] The Enigma of CAP-file header TIMESTAMPS ?

["Umesha S Anand" <umeshuv@xxxxxxxxxxxx>]

Title: Message

Hi

  Does ethereal support decoding of CAMEL/CAP messages ?? If so, can you let me know which version has the support.

Thanks & Regards,

Umesh.

---

From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Markku Tiuri
Sent: Monday, January 17, 2005 1:55 PM
To: ethereal-users@xxxxxxxxxxxx
Cc: Pasi.yliluoma@xxxxxxx
Subject: [Ethereal-users] The Enigma of CAP-file header TIMESTAMPS ?

This is an example af an XCP header of a Capture file

 58 43 50 00 30 30 32 2E 30 30 32 00 FB 8E 4E 41

 F6 EB 00 00 BE FF EF 03 80 00 00 00 DE AF 62 00

 0F 76 61 00 00 00 00 00 DE AF 62 00 00 00 00 00

 02 00 00 00 78 A2 24 CA A7 01 00 00 00 CA 9A 3B

 00 00 00 00 01 00 00 00 14 00 04 00 99 9E 36 00

 00 00 00 00 05 00 01 00 00 00 00 00 00 00 00 00

 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

 00 00 00 00 00 00 00 00 00 00 00 00 01 01 E0 E3

 

The field names might go like this..............................

 header | version | start time (low)

 time (high?) | something (number of frames) | start offset | end offset

 network information | 00 00

 (02) time unit | time low - time high - lines speed

some info 64 bytes

 

We do not know how the start time is calculated  - can anyone HELP us ?

We can calculate the times for the following frames in the CAP file if we

somehow can deduct the actual start time to which the frame times all are related to

Markku Tiuri
Product and Marketing Manager

NSF Telecom Ab                     
tel. +358 40 830 7807
markku.tiuri@xxxxxxxxxxx

http://www.nsftele.com
http://www.nsftelecom.fi
Continental office
Junailijankuja 4 B, FI-02430 Masala
tel. +358 9 250 45 11, fax. +358 9 250 45 12