Wireshark-bugs: [Wireshark-bugs] [Bug 9586] Peekremote dissector needs to handle "new" header as
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 23 Dec 2013 19:48:25 +0000

Comment # 12 on bug 9586 from 
(In reply to comment #11)
> (In reply to comment #4)
> > The decoding of the legacy header seems to be incorrect wrt
> > timesec/timeusec. My legacy trace spans ~180s but the seconds value remains
> > at 4. My best guess might be a 3 byte seconds and a 3 bytes useconds value -
> > but even that didn't fit too well.
> 
> This is from a 64-bit get-time. So I think the 4-byte each, should work as
> expected.

What do you mean by "a 64-bit get-time"?

At least in the captures Joerg and I have seen, treating that field as a 4-byte
seconds field and a 4-byte microseconds field does *NOT* work - the 4-byte
"microseconds" field is more than 1 million in one capture, and Joerg saw a
trace that covered more than 180 seconds but the 4-byte "seconds" value did not
change.

I *VERY STRONGLY* suspect that the field should be fetched as an *8-byte*
field, containing a value in microseconds - probably the TSF timer value.

You are receiving this mail because:
  • You are watching all bug changes.