This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

The documentation describes how to access the packet timestamps using pinfo.abs_ts and similar. However it is not clear as to how this time is represented. From looking at the source, it seems to be returned as epoch seconds using lua_nstime_to_sec.

Is there a way of getting a more precise timestamp for the packet, ideally with nanosecond precision, from Lua?

asked 17 Mar '14, 11:36

randomphrase's gravatar image

randomphrase
21225
accept rate: 0%


I haven't tried it, but what it should be doing is returning a Lua number with the fractional part representing the nanoseconds. So if the absolute time is 123456 seconds and 789 nanoseconds, when you get pinfo.abs_ts you should be getting back a Lua number of 123456.000000789.

A Lua number is a double, so it has a fractional component, and lua_nstime_to_sec tries to take advantage of that to give the nanoseconds. (I believe a double has enough precision in the fractional part to handle that correctly, though I could be wrong)

permanent link

answered 17 Mar '14, 11:53

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

edited 17 Mar '14, 11:54

Ah yes of course - don't know why I missed something so obvious.

For future reference, here's what worked for me:

local secs, frac = math.modf(pinfo.abs_ts)
local timestamp = NSTime(secs, math.modf(frac * 10^9))

(Possibly could be made more elegant by someone more knowledgable about Lua than I!)

(17 Mar '14, 12:36) randomphrase

There's no reason to do a math.modf() in the second argument to NSTime(). NSTime() will ignore any fractional component in its arguments.

Really what you're doing there anyway is giving NSTime() three arguments: (1) the secs, (2) the integral number of frac * 10^9, and (3) the fractional number of frac * 10^9. Luckily NSTime() ignores this third argument you're passing, but this might break someday if NSTime() is enhanced to take a third optional argument for something.

You could also do this instead, though I think your way is clearer and easier to read:

local timestamp = NSTime(pinfo.abs_ts, select(2,math.modf(pinfo.abs_ts)) * 10^9)
(17 Mar '14, 12:57) Hadriel

But maybe what we really need is for pinfo to provide a way to get the NSTime object as a return value for abs_ts (and the other times). So you don't have to do this shenanigans. :)

(17 Mar '14, 13:00) Hadriel
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431
×62
×12
×1

question asked: 17 Mar '14, 11:36

question was seen: 2,729 times

last updated: 17 Mar '14, 13:00

p​o​w​e​r​e​d by O​S​Q​A