Wireshark-users: Re: [Wireshark-users] Writing PcapNG with nanosecond timestamps
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 3 Dec 2012 11:37:47 -0800
On Dec 3, 2012, at 5:37 AM, Erik Hjelmvik <erik.hjelmvik@xxxxxxxxx> wrote:

> The Pcap-NG file format has support for using nano-second resolution
> timestamps, and from what I understand Wireshark uses nanoseconds
> internally. However, I'm not able to get Wireshark or dumpcap to write
> pcapng files with nanosecond resolution. All I get is the default
> microsecond timestamps.
> 
> Is there some switch or setting in Wireshark or dumpcap that I can use
> in order to enable nanosecond timestamps in the output pcapng file?

Given that dumpcap uses libpcap/WinPcap to do capturing, and libpcap/WinPcap deliver only microsecond-resolution time stamps, no, there's no such setting.  The pcap API is explicitly specified to deliver seconds-and-microseconds, so an API would have to be added to it to request higher-resolution time stamps.