PCap Timestamp

Wireshark
1

Hi,

I understand PCap generates a seconds timestamp and a milliseconds timestamp, each containing 4 bytes of hex.

I need to generate a function without the PCap development/build environment to convert the time into this format, however; I do not understand how the hex values relate to the UTC.

For example, how does A1 0F 50 4C | 35 4A 06 00 relate to 28/07/10 12:05:17.412213000.

Thanks.

2

The 1st group of 4 bytes is
the time in seconds since 1st january 1970 00:00:00.

The 2nd group of 4 bytes is
the micro-seconds (to add to the previous time).

The byte order seems to be little_endian/intel/inverted.
You have to invert them to understand.

1st group = 4C 50 0F A1 = 1280315297 seconds = ~14818 days = ~40.6 years then add 1970 = ~july 2010
2nd group = 00 06 4A 35 = 412213 micro-seconds

Olivier

3

Ha, oh yeah. It was the reverse ordering that confused me. Thanks for that!