From 46bbeea04060257c6257d14112c6a8d317d7f930 Mon Sep 17 00:00:00 2001 From: cinap_lenrek Date: Wed, 23 Dec 2015 02:00:09 +0100 Subject: snoopy: fix timestamps for pcap files (thanks BurnZeZ) the pcap files produced by snoopy had the wrong timestamps because it expected: /* magic=0xa1b2c3d4 */ ulong ts_sec; /* seconds*/ ulong ts_usec; /* microseconds */ but we wrote: uvlong ts; /* nanoseconds */ now, we write: /* magic=0xa1b23c4d */ ulong ts_sec; /* seconds */ ulong ts_nsec; /* nanoseconds */ --- sys/src/cmd/ip/snoopy/main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'sys/src/cmd/ip') diff --git a/sys/src/cmd/ip/snoopy/main.c b/sys/src/cmd/ip/snoopy/main.c index da0432959..db8078a3f 100644 --- a/sys/src/cmd/ip/snoopy/main.c +++ b/sys/src/cmd/ip/snoopy/main.c @@ -273,7 +273,7 @@ filterpkt(Filter *f, uchar *ps, uchar *pe, Proto *pr, int needroot) */ #define PCAP_VERSION_MAJOR 2 #define PCAP_VERSION_MINOR 4 -#define TCPDUMP_MAGIC 0xa1b2c3d4 +#define TCPDUMP_MAGIC 0xa1b23c4d struct pcap_file_header { ulong magic; @@ -286,7 +286,8 @@ struct pcap_file_header { }; struct pcap_pkthdr { - uvlong ts; /* time stamp */ + ulong ts_sec; + ulong ts_nsec; ulong caplen; /* length of portion present */ ulong len; /* length this packet (off wire) */ }; @@ -323,7 +324,8 @@ tracepkt(uchar *ps, int len) len = Mflag; if(pcap){ goo = (struct pcap_pkthdr*)(ps-16); - goo->ts = pkttime; + goo->ts_sec = (uvlong)pkttime / 1000000000; + goo->ts_nsec = (uvlong)pkttime % 1000000000; goo->caplen = len; goo->len = len; write(1, goo, len+16); -- cgit v1.2.3