lua dissector absolute time
Hello,
I've trying to parse 8 byte field with f.time = ProtoField.absolute_time("X.TimeStamp","TimeStamp", base.UTC)
.
Calling the field with subtree:add(f.time, buffer(0,8))
I'm getting year 2005 instead of 2020.
Any suggestion what I'm doing wrong?
In what fashion is the time encoded in that 8-byte field? 4-byte seconds since January 1, 1970, 00:00:00 UTC, followed by 4-byte microseconds, both big-endian? 4-byte seconds since January 1, 1970, 00:00:00 UTC, followed by 4-byte microseconds, both little-endian? 4-byte seconds since January 1, 1970, 00:00:00 UTC, followed by 4-byte nanoseconds, both big-endian? 4-byte seconds since January 1, 1970, 00:00:00 UTC, followed by 4-byte nanoseconds, both little-endian? Or something else?
UTC since 1/1/1970, IEEE double precision floating point. Intel format. 8 Bytes field
So which, if any, of the encodings listed at https://gitlab.com/wireshark/wireshar... is applicable?
And by Intel format., I take it that you mean Little-Endian format then? Assuming so, at the very least you should use
subtree:add_le(f.time, buffer(0,8))
.Ref: 11.7.2.1. treeitem:add_le([protofield], [tvbrange], [value], [label])
https://www.wireshark.org/docs/wsdg_h...