Re: [ethereal-dev] no 64 bit support, gryphon plugin

[Guy Harris <guy@xxxxxxxxxx>]

> On Thu, 10 Aug 2000, Guy Harris wrote:
>   The lower 4 bytes of the 8 byte value is the 4 byte Gryphon timestamp in
> tens of microseconds.  The upper 4 bytes of the 8 byte value is the
> overflow for the lower 4 bytes.  Every 11 hours, 55 minutes and 49.67296
> seconds the lower 4 bytes roll over from FFFF FFFF to 0000 0000 and the
> upper 4 bytes increment by one.
> 
>   Stated another way, the 8 byte value is the number of seconds past
> 0:00:00 GMT Jan 1, 1970 times 100,000 plus the current fraction of a
> second to 5 decimal places.  The lower 4 bytes of the 8 byte value are
> used as the Gryphon timestamp.

Actually, that's not stating it another way; the latter statement
contains more information than the former.

The latter statement makes it clear that the underlying time stamp is
based on the UNIX time stamp, i.e.  that the 64-bit Gryphon timestamp is
the number of 100,000ths of a second since the UNIX Epoch, and that the
32-bit Gryphon time stamp is the 64-bit Gryphon time stamp modulo
4,294,967,296, while the former statement - and the Gryphon protocol
documentation! - doesn't.

The "modulo 4,294,967,296" also indicates that the 32-bit Gryphon time
stamp wraps around, so that there's no guarantee that the difference
between two time stamps is the number of 100,000ths of a second between
them, although, if you compensate for a single wraparound by treating
the difference between the two time stamps as an *unsigned* value rather
than a *signed* value, that will happen only if the time stamp has
wrapped around at least twice in the interval between the two events.