Skip to content

How to make dump in pcap file with more sensitive in timestamp? #862

@minzak

Description

@minzak

When we uset typical dumping to PCAP in tshark we have this timestamps:

          "frame.time": "Feb  5, 2025 14:24:10.447573587 UTC",
          "frame.time_utc": "Feb  5, 2025 14:24:10.447573587 UTC",
          "frame.time_epoch": "1738765450.447573587",

When we use F-Stack native PCAP dumping, we have this:

          "frame.time": "Feb 21, 2025 19:00:52.899382000 UTC",
          "frame.time_utc": "Feb 21, 2025 19:00:52.899382000 UTC",
          "frame.time_epoch": "1740164452.899382000",

We fully lost all nanosec.
How to eliminate, fix it?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions