[pcap-ng-format] Issue #24: Need to specify the IDB if_tzone option format

[Stephen Donnelly]

Time stamps are noted as being in UTC, so presumably if_tzone is just a
display hint?

UTC is arguably not the ideal time base for packet traces or statistics, as
there are (leap) seconds occasionally with no valid UTC value. Could there
be a time base option (interface or section)  to specify e.g. TAI instead?
This time base is strictly monotonic and so does not suffer from the
vagaries of the earth's rotation. Conversion of TAI to UTC can be done with
the aid of lookup tables of leap seconds (although leap seconds themselves
still become ambiguous).

Stephen

On Tue, Aug 25, 2015 at 11:59 PM, Hadriel Kaplan <the.real.hadriel at gmail.com
> wrote:

> On Mon, Aug 24, 2015 at 12:57 PM, Guy Harris <guy at alum.mit.edu> wrote:
> >
> > On Aug 24, 2015, at 7:38 AM, Hadriel Kaplan <the.real.hadriel at gmail.com>
> wrote:
> >
> >> Currently the IDB if_tzone option is declared but not specified.
> >>
> >> Proposal: make it a signed int32 for number of seconds West of UTC.
> >
> > ...at the time that the IDB is inserted into the file, or when daylight
> savings time/summer time is not in effect?
> >
> > (For example, it's currently 16:57 UTC and 09:57 on the US West Coast at
> the time I'm typing this, for an offset of 7 hours, but if it were a few
> months later, it would be an offset of 8 hours.)
>
> The number of seconds in local Standard Time, West of UTC, regardless
> of current DST being in effect or not. (i.e., keep DST-handling in the
> presentation layer, not in the file contents)
>
> So for you it would be +8 hours (=28800 seconds) all the time.
>
> Or another direction would be to get rid of this 'if_tzone' option
> altogether.
>
> -hadriel
> _______________________________________________
> pcap-ng-format mailing list
> pcap-ng-format at winpcap.org
> https://www.winpcap.org/mailman/listinfo/pcap-ng-format
>



-- 
*Stephen Donnelly*
Engineering Manager CTO Group
Endace - Avago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150826/f782a8fa/attachment.html>