Re: Writing PcapNG with nanosecond timestamps

[Guy Harris <guy () alum mit edu>]

On Dec 3, 2012, at 5:37 AM, Erik Hjelmvik <erik.hjelmvik () gmail com> wrote:

> The Pcap-NG file format has support for using nano-second resolution
> timestamps, and from what I understand Wireshark uses nanoseconds
> internally. However, I'm not able to get Wireshark or dumpcap to write
> pcapng files with nanosecond resolution. All I get is the default
> microsecond timestamps.
>
> Is there some switch or setting in Wireshark or dumpcap that I can use
> in order to enable nanosecond timestamps in the output pcapng file?

Given that dumpcap uses libpcap/WinPcap to do capturing, and libpcap/WinPcap deliver only microsecond-resolution time 
stamps, no, there's no such setting.  The pcap API is explicitly specified to deliver seconds-and-microseconds, so an 
API would have to be added to it to request higher-resolution time stamps.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe