Timestamp in packets

[ahmadsulieman]

Is there a way to access the timestamp of a captured packet, and to also store it in the PCAP file when writing in it?

[sdaubert]

Hi @ahmadsulieman. Today, there is no way to get timestamp using Packetgen. But packetgen uses PcapRUB under the hood to capture pacckets. And PcapRUB can give you the timestamp:

require 'packetgen'
require 'pcaprub'

pcap = PCAPRUB::Pcap.create('eth0')
pcap.setpromisc(true)
pcap.setsnaplen(0xffff)
pcap.settimeout(1)
pcap.activate
pcap.each_packet do |pkt|
  p pkt.microsec
  puts "timestamp: #{Time.at(pkt.time) + pkt.microsec.to_r / 1_000_000}"
  p PacketGen.parse(pkt.data)
end

[sdaubert]

closed by #122