[Winpcap-users] timestamp

[Helmut Vaupotitsch]

Hello Jan,
converting in Delphi:

type
  PPcap_PktHdr = ^Tpcap_pkthdr;        // Wrapped Drivers packetHeader
  TPcap_pkthdr = record
  case integer of
    0: (ts     : TTimeVal;             // Time of capture (Unix's way of 
timestamping)  Do, 1.1.1970 0:0,0 (UTC) == Unix epoch
        CapLen,                        // length of portion present 
(captured length)
        Len    : Integer);             // actual length of packet (off wire)
    1: (stamp  : Int64);               // TSystemTime/TFileTime  - 
Windows epoch
                                       //   "ts" is converted to "stamp" 
on receiving the packets
  end;
Header: Ppcap_pkthdr

{ Convert Unix´s TTimeVal to Windows´s TFileTime: }
{ Convert the sec and usecs to hectonano seconds, then add the offset 
from the Unix epoch: Do, 1.1.1970 0:0,0 (UTC) }
Header.stamp:= (Int64(Header.ts.tv_sec) * 10000000) + (Header.ts.tv_usec 
* 10) + 116444736000000000;

best regards
Helmut


Jan Martinec schrieb:
> Hello!
> I've got a question about timestamping method. I know that a timestamp  
> is got using method QueryPerformanceCounter (resp.  
> keQueryPerformanceCounter), which is a number of ticks of Performance  
> counter. But timestamp is by Winpcap returned in "Seconds since Epoch"  
> format. So how is the recomputation done?
>
> Thank you very much
>
> Best regards,
> Jan Martinec
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>   

-- 
----------------------------------------------------------------
Ing. Helmut Vaupotitsch        Phone:  +43 (0)3133 3780 16
ITEC Tontechnik und            Fax:    +43 (0)3133 3780 9
Industrieelektronik GmbH       E-mail: hv at itec-audio.com
A-8200 Lassnitzthal 300        URL:    http://www.itec-audio.com
----------------------------------------------------------------