Re: tcpslice -r -d Always Returns Start + 10years

[Bill Fenner <fenner () research att com>]

This is a very good point.  The file_stop_time element was introduced
when the change was made to interleaving packets instead of concatenating;
nobody thought to set stop_time based on this new information.

It looks like dump_times() could take advantage of the states array
too, since it seems to do the exact same work as open_files().

Anyway, can you try the attached patch?  I'm particularly interested
in whether or not there's a fencepost error (e.g. last packet doesn't
get copied because it is at the stop_time).

Thanks,
  Bill

Attachment: tcpslice-stop-time.diff
Description: