Nanosecond precision on output file?

[Krypto411]

What would be involved in adding nanosecond precision to the output file of tcpslice? It seems to be reading the nanosecond precision files ok but in the output file it loses the nano and is just truncated to micro.

Thank you

[infrastation]

tcpslice uses the default libpcap precision, which is microseconds. Enabling nanosecond precision in the output file should be as simple as a call to pcap_set_tstamp_precision(), which should ideally be done only if at least one ns-precision packet makes it into the output file. Alternatively the condition could be that at least one input file has ns precision. Alternatively it could be a command-line flag.

One other related thing that is hard-coded to microseconds is the timestamp format parser, which currently does not allow to specify more than 6 decimal places for the fractional part.

[Krypto411]

So adding to open_files "pcap_set_tstamp_precision(s->p, PCAP_TSTAMP_PRECISION_NANO)" and changing
TS_RAW_US_MAX_DIGITS=9?

[infrastation]

Not exactly, plus several other changes. The US stands for microseconds, so if internally tcpslice starts to operate nanoseconds, that would have to be TS_RAW_NS_MAX_DIGITS, also microseconds are baked into quite a few more places, including struct timeval and the man page. With some attention to detail it should be practicable.