You still have to send the timezone offset over the wire in an open reply.

Removing it would be a *protocol* change, and there are clients out
there that expect the open reply to be 8 bytes long.  Just continue to
send a zero over the wire.

2 files changed, 9 insertions, 0 deletions

diff --git a/rpcap-protocol.h b/rpcap-protocol.h
index 231d5a60..47ab5757 100644
--- a/rpcap-protocol.h
+++ b/rpcap-protocol.h
@@ -323,6 +323,7 @@ struct rpcap_findalldevs_ifaddr
 struct rpcap_openreply
 {
 	int32 linktype;	/* Link type */
+	int32 tzoff;	/* Timezone offset - not used by newer clients */
 };
 
 /* Format of the message that starts a remote capture (startcap command) */
diff --git a/rpcapd/daemon.c b/rpcapd/daemon.c
index ab07117e..459fdf72 100644
--- a/rpcapd/daemon.c
+++ b/rpcapd/daemon.c
@@ -1736,6 +1736,14 @@ daemon_msg_open_req(struct daemon_slpars *pars, uint32 plen, char *source, size_
 
 	memset(openreply, 0, sizeof(struct rpcap_openreply));
 	openreply->linktype = htonl(pcap_datalink(fp));
+	/*
+	 * This is always 0 for live captures; we no longer support it
+	 * as something we read from capture files and supply to
+	 * clients, but we have to send it over the wire, as open
+	 * replies are expected to have 8 bytes of payload by
+	 * existing clients.
+	 */
+	openreply->tzoff = 0;
 
 	// We're done with the pcap_t.
 	pcap_close(fp);