1 Description:Tcpick can display timestamps in the output with the -t and -td switch. It currently computes a timestamp on the fly which has the following consequences
2 * Inaccurate timestamps when it is operated in real time mode (-i switch)
3 * Nonsense when reassembling off-line captures / when reading pcap files
5 Bug-Ubuntu:https://bugs.launchpad.net/ubuntu/+source/tcpick/+bug/364688
10 extern struct ip *ippacket;
11 extern struct tcphdr *tcppacket;
12 extern struct udphdr *udppacket;
13 +extern struct pcap_pkthdr* phdr;
14 extern u_char *payload;
15 extern int payload_len;
16 extern struct FLAGS flags;
21 struct tcphdr *tcppacket;
22 struct udphdr *udppacket;
23 +struct pcap_pkthdr* phdr = NULL;
31 { /* FIXME: this function is too long */
33 +/* Keep track of the original pcap header in order to put correct timestamps */
34 + phdr=(struct pcap_pkthdr *)hdr;
36 /* check if the flag for checking for expired connections
45 - struct timezone *tzp;
46 struct tm * brokentime;
48 if(flags.displaytime == NOTHING_TIME)
51 - tp = (struct timeval * ) S_malloc( sizeof(struct timeval) );
52 - tzp = (struct timezone * ) S_malloc( sizeof(struct timezone) );
56 - memset(tp, 0, sizeof(struct timeval));
57 - memset(tzp, 0, sizeof(struct timezone));
59 - if(gettimeofday(tp, tzp)) {
61 - perror("gettimeofday returned not 0!");
63 + perror("No timestamp was available!");
67 brokentime = localtime(&(tp->tv_sec));