This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture time using capinfos

0

'capinfos "filename" -u' rounds off capture time and does not return decimal places in windows. On Linux, however, it returns time to two decimal places.

Can you please clarify, how capture time upto two decimal places be retrieved using capinfos/tshark in windows environment?

asked 24 Jun '13, 07:47

Rajat's gravatar image

Rajat
1444
accept rate: 0%


2 Answers:

1

Adding the -T flag to get table output causes the duration to be printed with full precision on Windows.

Looking at the code, the output without the -T will show an integer value on all platforms. What versions did you test on Linux and Windows?

answered 24 Jun '13, 08:30

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

0

I would consider this a bug, as the result of the following command delivers a the duration time with decimals, even on Windows (in contrary to option -u).

capinfos input.pcap -T

Please file a bug/enhancement report at https://bugs.wireshark.org

Regards
Kurt

answered 24 Jun '13, 08:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 24 Jun '13, 08:41

Possibly a bug, but the code seems to be quite explicit in non-table mode that the duration should be shown with no decimal places.

(24 Jun '13, 08:59) grahamb ♦

non-table mode that the duration should be shown with no decimal places.

Then it is still a bug, as it show decimals on Linux (according to the OP statement) ;-)

ALTHOUGH: I cannot reproduce that effect on Linux, so maybe it's just a problem with the (yet unknown) version the OP tested with.

(24 Jun '13, 09:20) Kurt Knochner ♦

Yes: capinfos.c was changed in May 2009 to not print decimals for the capture duration (-u).

(24 Jun '13, 14:38) Bill Meier ♦♦

BTW: What was the motivation for that?

If the decimals are there, one can still take the full value and remove the decimals or round the value. So, why relinquish that possibility by not printing the decimals?

(24 Jun '13, 18:21) Kurt Knochner ♦

Fair question:

Digging deeper:

I've no idea why I made that explicit change to not show any decimals for the capture duration.

The code before I made the change: ... printf("Capture duration: %f seconds\n", cf_info->duration);

Did I (mistakenly) think %f format wouldn't print any decimals ? [I really don't want to believe I would have made that mistake. :) ]

In any case the current output formatting of certain vals seems inconsistent between the "Human Readable", "Machine Readable" and "Table" output modes.

I've filed a bug report ...

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8848

(25 Jun '13, 08:29) Bill Meier ♦♦

I've no idea why I made that explicit change

maybe just a copy-paste error? ;-)

(25 Jun '13, 08:35) Kurt Knochner ♦
showing 5 of 6 show 1 more comments