Skip to content

Conversation

@GioMusto
Copy link

@GioMusto GioMusto commented Jul 8, 2024

This new option allows having a grater precision in the timestamp offset of packets.

@guyharris
Copy link
Collaborator

So, in effect, the rules are:

  1. initialize a pair consisting of a 64-bit seconds value and a 32-bit nanoseconds value to {0, 0};
  2. if there's a ts_offset option, set the seconds value to the option's value;
  3. if there's a ts_nsoffset option, set the nanoseconds value to the option's value;
  4. for all packet from this interface, add the resulting seconds/nanoseconsds value to each time stamp.

What should be done if the time stamp resolution for this interface isn't 1 nanosecond? For example, what if it only has microsecond resolution?

An alternative would be to have an offset option that's a 64-bit value, with the same resolution as interface time stamps on the interface; you'd just add that value to the time stamp in a packet block; that seems a bit less complicated. The ts_offset value, if any, would be an additional offset to add, after the 64-bit offset is added.

(Having ts_offset be in seconds would provide a way to keep the pcapng file format usable for microsecond-resolution time stamps even after 2^63-1 microseconds (about 292271 years), usable for nanosecond-resolution time stamps even after 2^63-1 nanoseconds (about 292 years) and, if we ever need picosecond-resolution time stamps, even after 2^63-1 picoseconds (about .29 years).)

@GioMusto
Copy link
Author

GioMusto commented Jul 8, 2024

I also thought about the second option (having a separate 64-bit value), but I didn't like it because it provided potential overlap between the two options (i.e. multiple ways of expressing the same offset), but I agree it would provide more flexibility.

For that to work, we should still define a default precision in case there's no if_tsresol option. Also, is it ok having an option depending on another one?

@mcr mcr added the pcapv3 aka pcapng label Aug 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pcapv3 aka pcapng

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants