[PATCH v2] libpcapng: fix timestamp wrapping in output files

[Stephen Hemminger]

On Tue, 17 May 2022 11:01:15 +0100
Quentin Armitage <quentin at armitage.org.uk> wrote:

> In pcap_tsc_to_ns(), delta * NSEC_PER_SEC will overflow approx 8
> seconds after pcap_init is called when using a TSC with a frequency
> of 2.5GHz.
> 
> To avoid the overflow, update the saved time and TSC value once
> delta >= tsc_hz.
> 
> Fixes: 8d23ce8f5ee ("pcapng: add new library for writing pcapng files")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Quentin Armitage <quentin at armitage.org.uk>
> ---
> v2:
>   - Don't call clock_gettime() in fast path
>   - Update pcapng_time.ns and pcapng_time.cycles to ensure delta < tsc_hz
>   - Stop using constructor to initialise pcapng_time.tsc_hz since
>      it is not initialised until rte_eal_init() is called
>   - use mean value of TSC before and after call to clock_gettime()
>   - only call rte_get_tsc_hz() once
>   - use rte_reciprocal functions instead of division
> 
>  lib/pcapng/rte_pcapng.c | 47 ++++++++++++++++++++++++++++++++++++-----
>  1 file changed, 42 insertions(+), 5 deletions(-)

Side note: looked at an alternative using the timestamp offset option described in the
PCAPNG IETF standard.  

if_tsoffset:
	The if_tsoffset option is a 64-bit signed integer value that
specifies an offset (in seconds) that must be added to the timestamp of
each packet to obtain the absolute timestamp of a packet. If the option
is missing, the timestamps stored in the packet MUST be considered
absolute timestamps. The time zone of the offset can be specified with
the option if_tzone.


But not supported even by current wireshark so not useful.