tcpdump and timestamps

[Andrej van der Zee <andrejvanderzee () gmail com>]

Hi,

Today I received a tcpdump file from a client with timestamps that did
not correspond to the system clock. If I remember correctly, tcpdump
does not store complete timestamps but only a delta compared to the
first timestamp. I guess tcpdump does not read the system clock every
time, but has its own mechanisms. My question is, how does tcpdump
calculate its timestamps?

Thank you,
Andrej
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.