Re: [FINAL] timestamp field

[Johannes Berg <johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>]

On Fri, 2016-08-05 at 03:46 -0700, Guy Harris wrote:
> On Aug 4, 2016, at 10:48 PM, Johannes Berg <johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org
> > wrote:
> 
> > Since there was no objection, reposting as final - will adopt in a
> > week
> > from now unless there are any final objections.
> > 
> > The definition can be found at
> > http://www.radiotap.org/suggested-fields/timestamp
> 
> Does the fact that the Wireshark patch doesn't involve an
> FT_ABSOLUTE_TIME field mean that the time stamps aren't relative to
> some fixed time such as the UNIX epoch, so that they can be used to
> calculate the time between two events but not the wall-clock time of
> a single event?

I don't see a way to make them absolute, but it's something we could
consider adding perhaps? Maybe eventually wifi hardware will have some
clock sync with something.

Right now my main use-case is going to be exporting the timestamp from
the hardware, which isn't like the existing MACTIME, and then using
that to synchronize two or more captures (by finding common frames,
like beacons).

I must admit I hadn't thought about absolute times in the context of
radiotap at all.

johannes