On 2009-05-15 18:20, Guy Harris wrote:
On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote:
This has come up before, back when we were talking about the NG format.
I guess I got confused by the current context; if pcap files are
natively UTC (which I had thought they were until this thread arose
> "Ricardo" == Ricardo Balbinot writes:
Ricardo> tv.tv_sec = 1;
Ricardo> tv.tv_usec = 0;
Ricardo> FD_ZERO(&rfds);
Ricardo> FD_SET(handle_fd,&rfds);
Ricardo> retval = select(1, &rfds, NULL, NULL, &tv);
The first argument to select is the highest FD that you want to look at
On Fri, May 15, 2009 at 2:20 PM, Guy Harris wrote:
>
> On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote:
>
> This has come up before, back when we were talking about the NG format.
>> I guess I got confused by the current context; if pcap files are
>> natively UTC (which I had thought they we
Hi,
I have seen lots of messages around the list, but I do have a strange
problem.. in the code below, the select NEVER returns that the pcap
descriptor can be read...
It returns a timeout normally, and if I just use the pcap_dispatch function,
it works out just fine.. the problem is that I want
On May 13, 2009, at 3:46 PM, Johan Mazel wrote:
My reason of doing this is that I want to be able to aggregate
different
source of packets (eg.: I have eth0, eth1 eth2 and eth3 and I want to
capture on eth0 and eth1 only and build a trace from these
interfaces only).
My goal is to aggregate
On May 15, 2009, at 12:43 AM, Jefferson Ogata wrote:
This has come up before, back when we were talking about the NG
format.
I guess I got confused by the current context; if pcap files are
natively UTC (which I had thought they were until this thread arose,
seeming to suggest they weren't),
On 2009-05-15 03:10, Guy Harris wrote:
> On May 14, 2009, at 7:20 PM, Jefferson Ogata wrote:
>> But the point of storing the mostly irrelevant zone data as metadata
>> is so that it can be recorded when pcap timestamps are UTC, as they
>> always should have been. I'd like to find the person who dec