Skip to content

Commit

Permalink
pcapng: clarify what the ISB capture start and end times are.
Browse files Browse the repository at this point in the history
They're the times that capture started and ended on the interface in
question, which may not be the time that the capture, as a whole,
started, if, for example, the interface in question didn't exist when
the capture started, and capturing started when it was added.
  • Loading branch information
guyharris committed Jul 3, 2024
1 parent e6322c3 commit 60ff03b
Showing 1 changed file with 10 additions and 10 deletions.
20 changes: 10 additions & 10 deletions draft-ietf-opsawg-pcapng.md
Original file line number Diff line number Diff line change
Expand Up @@ -1877,11 +1877,11 @@ the following options are valid within this block:
{: indent='8'}
isb_starttime:
: The isb_starttime
option specifies the time the capture started, consisting of two
unsigned 32-bit values, in the same format as defined for timestamps
in the Enhanced Packet Block ({{section_epb}}), using the 'if_tsresol'
and 'if_tsoffset' values from the Interface Description Block
specified by the Interface ID.
option specifies the time that traffic capture started on this
interface, consisting of two unsigned 32-bit values, in the same
format as defined for timestamps in the Enhanced Packet Block
({{section_epb}}), using the 'if_tsresol' and 'if_tsoffset' values
from the Interface Description Block specified by the Interface ID.
{: vspace='0'}

Example: '96 c3 04 00 73 89 6a 65', in Little Endian, decodes
Expand All @@ -1891,11 +1891,11 @@ to 2012-06-29 06:17:00.834163 UTC.
{: indent='8'}
isb_endtime:
: The isb_endtime
option specifies the time the capture ended, consisting of two
unsigned 32-bit values, in the same format as defined for timestamps
in the Enhanced Packet Block ({{section_epb}}), using the 'if_tsresol'
and 'if_tsoffset' values from the Interface Description Block
specified by the Interface ID.
option specifies the time that traffic capture ended on this
interface, consisting of two unsigned 32-bit values, in the same
format as defined for timestamps in the Enhanced Packet Block
({{section_epb}}), using the 'if_tsresol' and 'if_tsoffset' values
from the Interface Description Block specified by the Interface ID.
{: vspace='0'}

Example: '97 c3 04 00 aa 47 ca 64', in Little Endian, decodes
Expand Down

0 comments on commit 60ff03b

Please sign in to comment.