[Winpcap-users] About struct timeval and header->ts.tv_usec

[Guy Harris]

On May 23, 2005, at 6:08 AM, HAMON Fran?ois wrote:

> Members:
> tv_sec :Time value, in seconds.
> tv_usec : Time value, in microseconds.

I.e., the time stamp of a packet is given as:

     tv_sec: seconds since January 1, 1970, 00:00:00 GMT (I don't  
think UTC existed at the time);

     tv_usec: microseconds since that second;

so a packet that arrived 1 millisecond after January 1, 1970,  
00:00:00 GMT would have a tv_sec value of 0 and a tv_usec value of 1000.

Note that tv_sec is seconds since a *GMT* time, so the time zone in  
which the capture was done doesn't matter.  UN*X applications tend to  
display those times in the local time zone in which the application  
is being run, which might be different from the time zone in which  
the capture was done.