Hi,
I understand PCap generates a seconds timestamp and a milliseconds timestamp, each containing 4 bytes of hex.
I need to generate a function without the PCap development/build environment to convert the time into this format, however; I do not understand how the hex values relate to the UTC.
For example, how does A1 0F 50 4C | 35 4A 06 00 relate to 28/07/10 12:05:17.412213000.
Thanks.
The 1st group of 4 bytes is
the time in seconds since 1st january 1970 00:00:00.
The 2nd group of 4 bytes is
the micro-seconds (to add to the previous time).
The byte order seems to be little_endian/intel/inverted.
You have to invert them to understand.
1st group = 4C 50 0F A1 = 1280315297 seconds = ~14818 days = ~40.6 years then add 1970 = ~july 2010
2nd group = 00 06 4A 35 = 412213 micro-seconds
Olivier
Ha, oh yeah. It was the reverse ordering that confused me. Thanks for that!