search

IETF-OPSAWG-WG / draft-ietf-opsawg-pcap

PCAP next generation file format specification
Other
272 stars 62 forks source link

Fix the examples for isb_starttime/isb_endtime #28

Closed hadrielk closed 5 years ago

hadrielk commented 9 years ago

No matter if leap seconds are counted or not, I'm pretty sure the example numbers for isb_starttime/isb_endtime are wrong. Presuming the resolution is microseconds (which, BTW, the draft does not say about those fields), then '97 c3 04 00 aa 47 ca 64' gives me 1340954905298858 microseconds since epoch; dividing by 1000000 gives ~1340954905 seconds, which is not 06/29/2012 06:16:50 UTC. In unix time it's 6/29/2012 07:28:25 UTC, which even accounting for ~35 leap seconds isn't right. [note: I could easily have screwed up the conversion somewhere though]

guyharris commented 5 years ago

Fixed, with a bunch of other cleanups, in bf17d7fe42e9c2b4a695bf816cae27be4c9c978a.

Given that these are UN*X-style times, leap seconds aren't, for better or worse, counted. Given that some hardware adapters provide Precision Time Protocol time stamps, which use 1970-01-01 00:00:00 TAI as the origin, and do count leap seconds, we may want to add information to the IDB to indicate whether the time stamps count leap seconds and what the origin is. (Note that there is no reason why one couldn't have time stamps that start at 1970-01-01 00:00:00 UTC and that count leap seconds, so "shifting the origin" and "counting vs. not-counting leap seconds" are independent, but don't get me started on leap seconds in UN*X....)