On Dec 28, 2012, at 3:53 PM, Guy Harris <g...@alum.mit.edu> wrote: > I would suggest, instead, that you: > > modify *libpcap*, so that it returns nanosecond-resolution time stamps;
I would also suggest that you modify it to write out pcap files with a different magic number, so that, if you ever run tcpdump with the -w flag, the files are flagged as having nanosecond-resolution time stamps. In the libpcap function sf_write_header(), have it write out NSEC_TCPDUMP_MAGIC rather than TCPDUMP_MAGIC. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
