Wireshark-dev: Re: [Wireshark-dev] wiretap - using as a library rather than coupled with Wiresh
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 3 Dec 2015 14:28:16 -0800
On Dec 3, 2015, at 2:02 PM, Richard Kinder <rkinder@xxxxxxxxxxxxx> wrote:

> and I get something which is pcap + RT. I’m pushing the packet timestamp from the airopeek capture into the tsfts RT field,

"RT" as in "radiotap"?

If so, the packet timestamp should not be used as the TSF timestamp value; instead, if the PHDR_802_11_HAS_TSF_TIMESTAMP bit is set in the presence_flags field of the "struct ieee_802_11_phdr" pseudo-header, use the tsf_timestamp field of that structure as the TSFT field in the radiotap header, otherwise don't put a TSFT field into the radiotap header.