From 8f515b1a99d0043966a8d287cee38fe67e06d189 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Tue, 28 Mar 2017 03:17:48 -0700 Subject: Fix up time encodings. Add some new encodings for absolute time stamps, and use them as appropriate; this fixes some cases where the time stamps in question were being dissected incorrectly. For the encodings with seconds and 1/2^32s of a second, don't arbitrarily give only microsecond resolution; 2^32 is greater than 1 million, and, in fact, at least some NTP RFCs explicitly talk about time resolution greater than 1 microsecond. Update references in the RELOAD dissector to reflect the documents in question having been updated and published as RFCs. Change-Id: Icbe0b696d65eb622978eb71e99ddf699b84e4fca Reviewed-on: https://code.wireshark.org/review/20759 Reviewed-by: Guy Harris --- doc/README.dissector | 58 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 50 insertions(+), 8 deletions(-) (limited to 'doc/README.dissector') diff --git a/doc/README.dissector b/doc/README.dissector index 3a722cb87f..f3b1d61897 100644 --- a/doc/README.dissector +++ b/doc/README.dissector @@ -1598,15 +1598,57 @@ For FT_ABSOLUTE_TIME fields, the encoding specifies the form in which the time stamp is specified, as well as its byte order. The time stamp encodings that are currently supported are: - ENC_TIME_TIMESPEC - seconds (4 bytes) and nanoseconds (4 bytes) - of time since January 1, 1970, midnight UTC. - (If the field length is 4, then nanosecs is defaulted to 0). - - ENC_TIME_NTP - an NTP timestamp, represented as a 64-bit - unsigned fixed-point number, in seconds relative to 0h - on 1 January 1900. The integer part is in the first 32 - bits and the fraction part in the last 32 bits. + ENC_TIME_TIMESPEC - 8 bytes; the first 4 bytes are seconds since + the UN*X epoch (1970-01-01 00:00:00 UTC) and the next 4 bytes + are nanoseconds since that second. (I.e., a UN*X struct + timespec with a 4-byte time_t.) + + ENC_TIME_NTP - 8 bytes; the first 4 bytes are seconds since the NTP + epoch (1901-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of + a second since that second. (I.e., a 64-bit count of 1/2^32's of a + second since the NTP epoch, with the upper 32 bits first and the + lower 32 bits second, even when little-endian.) + + ENC_TIME_TOD - 8 bytes, as a count of microseconds since the System/3x0 + and z/Architecture epoch (1900-01-01 00:00:00 GMT). + + ENC_TIME_RTPS - 8 bytes; the first 4 bytes are seconds since the UN*X + epoch and the next 4 bytes are are 1/2^32's of a second since that + second. (I.e., it's the offspring of a mating between UN*X time and + NTP time.) It's used by the Object Management Group's Real-Time + Publish-Subscribe Wire Protocol for the Data Distribution Service. + + ENC_TIME_TIMEVAL - 8 bytes; the first 4 bytes are seconds since the + UN*X epoch and the next 4 bytes are microseconds since that + second. (I.e., a UN*X struct timeval with a 4-byte time_t.) + + ENC_TIME_SECS - 4 to 8 bytes, representing a value in seconds since + the UN*X epoch. + + ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds + since the UN*X epoch. + + ENC_TIME_SECS_NTP - 4 bytes, representing a count of seconds since + the NTP epoch. (I.e., seconds since the NTP epoch.) + + ENC_TIME_RFC_3971 - 8 bytes, representing a count of 1/64ths of a + second since the UN*X epoch; see section 5.3.1 "Timestamp Option" + in RFC 3971. + +For FT_RELATIVE_TIME fields, the encoding specifies the form in which +the time stamp is specified, as well as its byte order. The time stamp +encodings that are currently supported are: + ENC_TIME_TIMESPEC - 8 bytes; the first 4 bytes are seconds and the + next 4 bytes are nanoseconds. + + ENC_TIME_TIMEVAL - 8 bytes; the first 4 bytes are seconds and the + next 4 bytes are microseconds. + + ENC_TIME_SECS - 4 to 8 bytes, representing a value in seconds. + + ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds. + For other types, there is no support for proto_tree_add_item(). Now that definitions of fields have detailed information about bitfield -- cgit v1.2.1