0

I've recorded some pcap files with tcpdump with option --time-stamp-precision nano given,

and I can print the timestamps of these pcap files with tcpdump using a command like

tcpdump -r <my_pcap_file> -ttt

However, I can't seem to read the timestamp using libpcap, the best I'm getting now is microsecond resolution.

I found a recent post here that mentions that it's not supported yet in libpcap: https://github.com/google/gopacket/issues/298

Is this still true? Or do I need to check out pcapgo mentioned in the post?

nancyheidilee
  • 322
  • 1
  • 2
  • 10

1 Answers1

0

The answer to the post below answered my question!

Read nanosecond pcap file using libpcap

At first I was using a pcap file that actually had microsecond resolution, and I assumed that using pcap_open_offline_with_tstamp_precision(pathname, PCAP_TSTAMP_PRECISION_NANO, errbuf); to open the pcap file should make the tv_usec in struct timeval be in nanoseconds, but this seems to be true only when the pcap file actually has nanosecond time stamps.

nancyheidilee
  • 322
  • 1
  • 2
  • 10