diff options
| -rw-r--r-- | pcap-savefile.manfile.in | 15 | ||||
| -rw-r--r-- | pcap-sita.html | 2 | ||||
| -rw-r--r-- | pcap/pcap.h | 4 | ||||
| -rw-r--r-- | sf-pcap.c | 5 |
4 files changed, 14 insertions, 12 deletions
diff --git a/pcap-savefile.manfile.in b/pcap-savefile.manfile.in index a7ae9afb..1bfebe22 100644 --- a/pcap-savefile.manfile.in +++ b/pcap-savefile.manfile.in @@ -41,9 +41,9 @@ Magic number _ Major version Minor version _ -Time zone offset +Reverved1 _ -Time stamp accuracy +Reverved2 _ Snapshot length _ @@ -80,10 +80,15 @@ A 2-byte file format major version number; the current version number is A 2-byte file format minor version number; the current version number is 4. .IP -A 4-byte time zone offset; this is always 0. +A 4-byte not used - SHOULD be filled with 0 by pcap file writers, and MUST +be ignored by pcap file readers. This value was documented by some older +implementations as "gmt to local correction" or "time zone offset". +Some older pcap file writers stored non-zero values in this field. .IP -A 4-byte number giving the accuracy of time stamps in the file; this is -always 0. +A 4-byte not used - SHOULD be filled with 0 by pcap file writers, and MUST +be ignored by pcap file readers. This value was documented by some older +implementations as "accuracy of timestamps". Some older pcap file +writers stored non-zero values in this field. .IP A 4-byte number giving the "snapshot length" of the capture; packets longer than the snapshot length are truncated to the snapshot length, so diff --git a/pcap-sita.html b/pcap-sita.html index cb88aabe..7cf3734f 100644 --- a/pcap-sita.html +++ b/pcap-sita.html @@ -803,8 +803,6 @@ A { text-decoration:none } this is also known as a UN*X time_t. You can use the ANSI C <em>time()</em> function from <em>time.h</em> to get this value, but you might use a more optimized way to get this timestamp value. - If this timestamp isn't based on GMT (UTC), use <em>thiszone</em> - from the global header for adjustments.</TD> </TR> <TR> <TD VALIGN=TOP>tv_usec</TD> diff --git a/pcap/pcap.h b/pcap/pcap.h index 53733b54..3228a39f 100644 --- a/pcap/pcap.h +++ b/pcap/pcap.h @@ -208,8 +208,8 @@ struct pcap_file_header { bpf_u_int32 magic; u_short version_major; u_short version_minor; - bpf_int32 thiszone; /* gmt to local correction; this is always 0 */ - bpf_u_int32 sigfigs; /* accuracy of timestamps; this is always 0 */ + bpf_int32 thiszone; /* not used - SHOULD be filled with 0 */ + bpf_u_int32 sigfigs; /* not used - SHOULD be filled with 0 */ bpf_u_int32 snaplen; /* max length saved portion of each pkt */ bpf_u_int32 linktype; /* data link type (LINKTYPE_*) */ }; @@ -731,9 +731,8 @@ sf_write_header(pcap_t *p, FILE *fp, int linktype, int snaplen) /* * https://www.tcpdump.org/manpages/pcap-savefile.5.txt states: - * thiszone: 4-byte time zone offset; this is always 0. - * sigfigs: 4-byte number giving the accuracy of time stamps - * in the file; this is always 0. + * thiszone (Reserved1): 4-byte not used - SHOULD be filled with 0 + * sigfigs (Reserved2): 4-byte not used - SHOULD be filled with 0 */ hdr.thiszone = 0; hdr.sigfigs = 0; |