Re: [PATCH] Pcap recv time for NSE scripts, qscan.nse update

[majek04 <majek04+nmap-dev () gmail com>]

On Thu, Jul 22, 2010 at 02:31, Kris Katterjohn <katterjohn () gmail com> wrote:
> I've attached a patch to let NSE scripts obtain the pcap capture time through
> pcap_receive() instead of (in the case of qscan.nse) having to resort to using
> clock_ms().
>
> For whatever reason it was chosen to have a msec function clock_ms(), I chose
> to have the pcap time returned as msecs instead of the usual usec available in
> struct timeval.  I don't see a point in having different resolutions here
> causing scripts to have to perform conversions.  Unless a usec clock function
> is desired, in which case the pcap time should be usec as well.  Personally, I
> don't think that's such a bad idea.

Kris,

From what I remember, pcap_receive doesn't return proper timestamp on
windows. Instead of sharing real time of when the packet was captured
it just returned current time. Or something like that.

Though, my knowledge is pretty old and there are fair chances it has
been fixed since.

Even so, in most cases it doesn't really matter, and it should way
better to use pcap_receive timestamp than clock_ms.

Thanks!

 Marek Majkowski
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/