Re: [tcpdump-workers] local timestamp recovery of .cap files

2009-05-15 Thread Jefferson Ogata
On 2009-05-15 18:20, Guy Harris wrote: On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote: This has come up before, back when we were talking about the NG format. I guess I got confused by the current context; if pcap files are natively UTC (which I had thought they were until this thread arose

Re: [tcpdump-workers] Problems with select (the other way around...)

2009-05-15 Thread Michael Richardson
> "Ricardo" == Ricardo Balbinot writes: Ricardo> tv.tv_sec = 1; Ricardo> tv.tv_usec = 0; Ricardo> FD_ZERO(&rfds); Ricardo> FD_SET(handle_fd,&rfds); Ricardo> retval = select(1, &rfds, NULL, NULL, &tv); The first argument to select is the highest FD that you want to look at

Re: [tcpdump-workers] local timestamp recovery of .cap files

2009-05-15 Thread rh
On Fri, May 15, 2009 at 2:20 PM, Guy Harris wrote: > > On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote: > > This has come up before, back when we were talking about the NG format. >> I guess I got confused by the current context; if pcap files are >> natively UTC (which I had thought they we

[tcpdump-workers] Problems with select (the other way around...)

2009-05-15 Thread Ricardo Balbinot
Hi, I have seen lots of messages around the list, but I do have a strange problem.. in the code below, the select NEVER returns that the pcap descriptor can be read... It returns a timeout normally, and if I just use the pcap_dispatch function, it works out just fine.. the problem is that I want

Re: [tcpdump-workers] Problem with generation of Pcap traces for

2009-05-15 Thread Guy Harris
On May 13, 2009, at 3:46 PM, Johan Mazel wrote: My reason of doing this is that I want to be able to aggregate different source of packets (eg.: I have eth0, eth1 eth2 and eth3 and I want to capture on eth0 and eth1 only and build a trace from these interfaces only). My goal is to aggregate

Re: [tcpdump-workers] local timestamp recovery of .cap files

2009-05-15 Thread Guy Harris
On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote: This has come up before, back when we were talking about the NG format. I guess I got confused by the current context; if pcap files are natively UTC (which I had thought they were until this thread arose, seeming to suggest they weren't),

Re: [tcpdump-workers] local timestamp recovery of .cap files

2009-05-15 Thread Jefferson Ogata
On 2009-05-15 03:10, Guy Harris wrote: > On May 14, 2009, at 7:20 PM, Jefferson Ogata wrote: >> But the point of storing the mostly irrelevant zone data as metadata >> is so that it can be recorded when pcap timestamps are UTC, as they >> always should have been. I'd like to find the person who dec