This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Extract Pinfo timestamp with better than second precision from Lua?

0

The documentation describes how to access the packet timestamps using pinfo.abs_ts and similar. However it is not clear as to how this time is represented. From looking at the source, it seems to be returned as epoch seconds using lua_nstime_to_sec.

Is there a way of getting a more precise timestamp for the packet, ideally with nanosecond precision, from Lua?

asked 17 Mar '14, 11:36

randomphrase's gravatar image

randomphrase
21225
accept rate: 0%


One Answer:

0

I haven't tried it, but what it should be doing is returning a Lua number with the fractional part representing the nanoseconds. So if the absolute time is 123456 seconds and 789 nanoseconds, when you get pinfo.abs_ts you should be getting back a Lua number of 123456.000000789.

A Lua number is a double, so it has a fractional component, and lua_nstime_to_sec tries to take advantage of that to give the nanoseconds. (I believe a double has enough precision in the fractional part to handle that correctly, though I could be wrong)

answered 17 Mar '14, 11:53

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

edited 17 Mar '14, 11:54

Ah yes of course - don't know why I missed something so obvious.

For future reference, here's what worked for me:

local secs, frac = math.modf(pinfo.abs_ts)
local timestamp = NSTime(secs, math.modf(frac * 10^9))

(Possibly could be made more elegant by someone more knowledgable about Lua than I!)

(17 Mar '14, 12:36) randomphrase

There's no reason to do a math.modf() in the second argument to NSTime(). NSTime() will ignore any fractional component in its arguments.

Really what you're doing there anyway is giving NSTime() three arguments: (1) the secs, (2) the integral number of frac * 10^9, and (3) the fractional number of frac * 10^9. Luckily NSTime() ignores this third argument you're passing, but this might break someday if NSTime() is enhanced to take a third optional argument for something.

You could also do this instead, though I think your way is clearer and easier to read:

local timestamp = NSTime(pinfo.abs_ts, select(2,math.modf(pinfo.abs_ts)) * 10^9)
(17 Mar '14, 12:57) Hadriel

But maybe what we really need is for pinfo to provide a way to get the NSTime object as a return value for abs_ts (and the other times). So you don't have to do this shenanigans. :)

(17 Mar '14, 13:00) Hadriel