On Tue, Jun 05, 2001 at 02:32:29PM -0500, Hardiman, Mark A Contractor/NCCIM wrote: > I'm having a problem with tcpdump-3.6.2, libpcap-0.6.2 and RedHat7.1. I am > getting two decimal places for the milliseconds instead of the full six. I think > it is libpcap-0.6.2 that is the problem. Can you send this to the correct > person? "The correct person" for bug reports is [EMAIL PROTECTED], not [EMAIL PROTECTED]; patches is for fixes, not bugs. > Here is the log (Sanitized): > > 198.162.32.215 > xxx.xxx.xxx.xxx > 00:03:39.450000 somewhere.on.the.net.1149 > xxx.xxx.xxx.xxx.135: S > 2836809269:2836809269(0) win 16384 (DF) > 00:03:42.630000 somewhere.on.the.net.1149 > xxx.xxx.xxx.xxx.135: S > 2836809269:2836809269(0) win 16384 (DF) I think it unlikely that libpcap is the problem - 0.6.2 merely does an SIOCGSTAMP "ioctl" call to get the time stamp from the kernel, so it just gives its caller what it got from the kernel. It's unlikely to be tcpdump, either, as it just prints with "%06u" the microseconds value it got from libpcap (which, as noted, is just what libpcap got from the kernel). Perhaps the Linux networking code isn't getting a sufficiently high-resolution time stamp? > 00:03:49.200000 somewhere.on.the.net.1149 > xxx.xxx.xxx.xxx.135: S > 2836809269:2836809269(0) win 16384 (DF) > 00:04:02.500000 somewhere.on.the.net.1163 > xxx.xxx.xxx.xxx.135: S > 3259847217:3259847217(0) win 16384 (DF) > 00:04:05.710000 somewhere.on.the.net.1163 > xxx.xxx.xxx.xxx.135: S > 3259847217:3259847217(0) win 16384 (DF) > 00:04:12.280000 somewhere.on.the.net.1163 > xxx.xxx.xxx.xxx.135: S > 3259847217:3259847217(0) win 16384 (DF) > 00:04:57.550000 somewhere.on.the.net.1194 > xxx.xxx.xxx.xxx.135: S > 2338289000:2338289000(0) win 16384 (DF) > 00:05:00.740000 somewhere.on.the.net.1194 > xxx.xxx.xxx.xxx.135: S > 2338289000:2338289000(0) win 16384 (DF) > 00:05:07.300000 somewhere.on.the.net.1194 > xxx.xxx.xxx.xxx.135: S > 2338289000:2338289000(0) win 16384 (DF) > 00:05:14.100000 somewhere.on.the.net.1195 > xxx.xxx.xxx.xxx.135: S > 2445288674:2445288674(0) win 16384 (DF) > 00:05:17.370000 somewhere.on.the.net.1195 > xxx.xxx.xxx.xxx.135: S > 2445288674:2445288674(0) win 16384 (DF) > 00:05:21.590000 somewhere.on.the.net.1196 > xxx.xxx.xxx.xxx.135: S > 3224938981:3224938981(0) win 16384 (DF) > 00:05:23.930000 somewhere.on.the.net.1195 > xxx.xxx.xxx.xxx.135: S > 2445288674:2445288674(0) win 16384 (DF) > > Thank's > Mark Hardiman > > - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
