timestamp bug on reading pcap-ng file with PCAP_TSTAMP_PRECISION_NANO #349

Closed
nonakaQubit opened this Issue Apr 4, 2014 · 3 comments

Projects

None yet

3 participants

@nonakaQubit

libpcap-1.5.3

reading pcap-ng file by 'pcap_open_offline_with_tstamp_precision' with PCAP_TSTAMP_PRECISION_NANO and 'pcap_loop', readed pcap_pkthdr has not 'nanosec' timestamp, but has 'millisec' timestamp.

sf-pcap-ng.c:
now:
1240 frac *= ps->ifaces[interface_id].tsresol;
1241 frac /= ps->user_tsresol;

fixed:
1240 frac *= ps->user_tsresol;
1241 frac /= ps->ifaces[interface_id].tsresol;

@nonakaQubit nonakaQubit closed this Apr 4, 2014
@nonakaQubit nonakaQubit reopened this Apr 4, 2014
@guyharris
Member

Should be fixed in fd2025c.

@guyharris guyharris closed this Apr 6, 2014
@guyharris guyharris added a commit that referenced this issue Apr 6, 2014
@guyharris guyharris Fix the case where the requested resolution is higher than the iface …
…resol.

(I'd say "interface resolution", but, well, this is Git, home of the
"fit a summary of the change in one line, even if it kills you", and I
happen to have microEMACS's running in an 80-position-wide window.  Even
that's probably too long for Git....)

This should fix issue #349.
fd2025c
@georgmu
georgmu commented Dec 1, 2014

This change destroys the previously correct behavior if the file has nanosecond resolution, but the requested resolution is microseconds.

In this case, the frac is much bigger than 1 second.

Example:
ps->ifaces[interface_id].tsresol = 1000000000
ps->user_tsresol = 1000000

fraction read from packet is 302145000 (0.302145s)

After the conversion with the current code, the value of the fraction is 302145000000.

Correct value would be 302145.

@georgmu
georgmu commented Dec 1, 2014

It is correct, that SCALE_UP and SCALE_DOWN can be handled equal, but the order is wrong:

current:
frac *= ps->ifaces[interface_id].tsresol;
frac /= ps->user_tsresol;

correct (as mentioned by the opener of the ticker):
frac *= ps->user_tsresol;
frac /= ps->ifaces[interface_id].tsresol;

@guyharris guyharris changed the title from timpstamp bug on reading pcap-ng file with PCAP_TSTAMP_PRECISION_NANO to timestamp bug on reading pcap-ng file with PCAP_TSTAMP_PRECISION_NANO Dec 1, 2014
@guyharris guyharris added a commit that referenced this issue Dec 12, 2014
@guyharris guyharris Fix the case where the requested resolution is higher than the iface …
…resol.

(I'd say "interface resolution", but, well, this is Git, home of the
"fit a summary of the change in one line, even if it kills you", and I
happen to have microEMACS's running in an 80-position-wide window.  Even
that's probably too long for Git....)

This should fix issue #349.
ca65148
@guyharris guyharris added a commit that referenced this issue Jan 15, 2015
@guyharris guyharris Fix the case where the requested resolution is higher than the iface …
…resol.

(I'd say "interface resolution", but, well, this is Git, home of the
"fit a summary of the change in one line, even if it kills you", and I
happen to have microEMACS's running in an 80-position-wide window.  Even
that's probably too long for Git....)

This should fix issue #349.
310b5d9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment