RE: [ethereal-dev] 64-bit pcap timestamp problems

["Brown, Wes" <Wes_Brown@xxxxxxx>]

Solaris 7 is the first release with support for 64-bit stuff in 
the kernel.

However, I'm apparently running Solaris 2.5.1 and 2.6 on these
machines, which would be 32-bit.  I do recall Solaris-2.6
having /some/ 64 bit stuf.  I don't recall what exactly.

$ uname -a
SunOS crimson 5.5.1 Generic sun4m sparc Tadpole_S3GX

$ uname -a
SunOS n1us2h 5.6 Generic_105181-12 sun4u sparc SUNW,Ultra-2

$ uname -a
SunOS sun90 5.6 Generic_105181-05 sun4u sparc SUNW,Ultra-Enterprise

Wes


-----Original Message-----
From: Gilbert Ramirez [mailto:gram@xxxxxxxxxx]
Sent: Friday, August 06, 1999 4:34 PM
To: John Heffner
Cc: ethereal-dev@xxxxxxxx; Wes_Brown@xxxxxxx
Subject: Re: [ethereal-dev] 64-bit pcap timestamp problems


Perhaps. Wes Brown is having libpcap difficulties on Solaris.

Wes, are you using an UltraSPARC with Solaris 7? (Is that the one what
uses the 64-bit mode of the ultrasparc?)

--gilbert

On Fri, Aug 06, 1999 at 04:21:58PM -0500, John Heffner wrote:
> 
> 
> I'm running linux-2.2.10, redhat-5.2 on an alpha.  With the 2.2-series
> kernel on alpha, the seconds and microseconds are stored as 64-bit
> integers instead of 32-bit integers.  This is a nasty little problem I ran
> into with the stock tcpdump/libpcap in the stock redhat-5.2/alpha (glibc
> 2.0). The headers that come with redhat define a timestamp as two 32-bit
> ints, and this causes all sorts of nastyness.  I got it to work by
> building libpcap/tcpdump after changing the struct timeval in timebits.h
> to look like the one in the kernel.  I beleive RedHat have made this same
> change as of 6.0 (glibc 2.1).
> 
> Anyway, I've run into basically the same problem with ethereal.  struct
> pcaprec_hdr has 32-bit ints for its secs and usecs hardcoded into it, and
> this breaks very badly.  I got it to work by changing these to 64-bit
> ints.
> 
> struct pcaprec_hdr maybe should be changed to use a struct timeval
> as defined in timebits.h, like libpcap does.  There's a big problem with
> this, though -- traces on 64-bit machines won't be viewable on 32-bit
> machines and vica versa.  This seems like a problem with libpcap.  Perhaps
> is should be changed so that secs and usecs are always written as 32-bit
> values?
> 
> <sigh> Life is so much simpler with i386...
> 
> Anybody else dealt with this problem already and know more about it than
> I do?  I just subscribed to this list about 30 minutes ago...
> 
>   -John