Add support for getting nanosecond time stamp resolution when capturing.

If we have pcap_set_tstamp_precision(), use it to request nanosecond
time stamp resolution *if* we're writing a pcap-ng file; any code that
reads those files and can't handle nanosecond time stamp resolution is
broken and needs to be fixed.

If we're writing a pcap file, don't ask for nanosecond resolution time
stamps, as that requires a different magic number for pcap files, and
not all code that reads pcap files can handle that.  (Unlike pcap-ng,
where the ability to have non-microsecond time stamp resolution was
present from Day One, it's a relatively recent addition to pcap.)  We
could add a command-line option/GUI option for that, like the option
recent versions of tcpdump have, if it matters.

Change-Id: I8fa464eb929feecb9a70be70712502c9f0cc5270
Reviewed-on: https://code.wireshark.org/review/4355
Reviewed-by: Guy Harris <guy@alum.mit.edu>

1 files changed, 31 insertions, 0 deletions

diff --git a/dumpcap.c b/dumpcap.c
index 0ae6bac38f..809ce6cf02 100644
--- a/dumpcap.c
+++ b/dumpcap.c
@@ -714,6 +714,31 @@ open_capture_device(interface_options *interface_opts,
             pcap_set_promisc(pcap_h, interface_opts->promisc_mode);
             pcap_set_timeout(pcap_h, CAP_READ_TIMEOUT);
 
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+            /*
+             * If we're writing pcap-ng files, try to enable
+             * nanosecond-resolution capture; any code that
+             * can read pcap-ng files must be able to handle
+             * nanosecond-resolution time stamps.
+             *
+             * If we're writing pcap files, don't try to enable
+             * nanosecond-resolution capture, as not all code
+             * that reads pcap files recognizes the nanosecond-
+             * resolution pcap file magic number.
+             */
+            if (capture_opts->use_pcapng) {
+                /*
+                 * The only errors this is documenting as returning
+                 * are PCAP_ERROR_TSTAMP_PRECISION_NOTSUP, which just
+                 * means we can't do nanosecond precision on this adapter,
+                 * in which case we just live with whatever resolution
+                 * we get by default, and PCAP_ERROR_ACTIVATED, which
+                 * can't happen as we haven't activated the pcap_t yet.
+                 */
+                pcap_set_tstamp_precision(pcap_h, PCAP_TSTAMP_PRECISION_NANO);
+            }
+#endif
+
             g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
                   "buffersize %d.", interface_opts->buffer_size);
             if (interface_opts->buffer_size != 0) {
@@ -2638,6 +2663,12 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
 
         if (pcap_opts->pcap_h != NULL) {
             /* we've opened "iface" as a network device */
+
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+            /* Find out if we're getting nanosecond-precision time stamps */
+            pcap_opts->ts_nsec = pcap_get_tstamp_precision(pcap_opts->pcap_h) == PCAP_TSTAMP_PRECISION_NANO;
+#endif
+
 #ifdef _WIN32
             /* try to set the capture buffer size */
             if (interface_opts.buffer_size > 1 &&