When you try to read a pcapng file and save it to a new pcapng file, the timestamp was trimmed down! The decimal place is moved to the front and the last digit is rounded off. The timestamp is no longer correct. Could anyone please help how to correct it? Thanks a lot!
That's not losing precision, that's getting significantly changed - the integer portions of 1340398414.509256500 and 134039841.450925600 are significantly different.
Please file a bug against whatever versions of Wireshark have this problem, even if it's prior to 1.8.0. TShark might be failing to set the time stamp resolution correctly in the Interface Description Block(s) in the output file:
so the resolution might be off by a factor of 10.
answered 03 Jul '12, 16:12
Guy Harris ♦♦