Fixes the following issues with PCAP DLT_ERF files written by opapacketcapture:
Timestamp (64-bit fixed point little endian not seconds/nanoseconds).
Record length field (total record length not packet length).
PCAP length fields (to be ERF record length). These were coincidentally the
correct value despite being calculated based off the wrong (PCAP) struct length.
Change PCAP magic to nanosecond format to match what was being written to the file.
The PCAP magic change may reduce compatibility with tools and versions of PCAP that only support microsecond timestamps. The alternative would be to change PCAP timestamp (not ERF) to microseconds. Wireshark uses the ERF timestamp instead of the PCAP timestamp for DLT_ERF records anyway. Without this a tool reading the PCAP timestamp will show the wrong subsecond value.
As we don't currently have Omni-Path hardware so have been unable to test these changes beyond compiling and careful reading. We would like to check some resulting PCAP files to confirm the changes are working as intended.
Fixes the following issues with PCAP DLT_ERF files written by opapacketcapture:
The PCAP magic change may reduce compatibility with tools and versions of PCAP that only support microsecond timestamps. The alternative would be to change PCAP timestamp (not ERF) to microseconds. Wireshark uses the ERF timestamp instead of the PCAP timestamp for DLT_ERF records anyway. Without this a tool reading the PCAP timestamp will show the wrong subsecond value.
As we don't currently have Omni-Path hardware so have been unable to test these changes beyond compiling and careful reading. We would like to check some resulting PCAP files to confirm the changes are working as intended.