You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Latest experiment indicates that pcap is not the issue, packets are
getting non-zero timestamps. The question then becomes: How is it
possible to observed parsed network traffic where both the first packet
and last packet timestamps are zero if we can definitely see that pcap
timestamped each packet correctly?
I think this indicates that the zero timestamp issue must be coming from
within the the assembler or within the `stream.go` file. The following
change will confirm which of the two.
Either:
- The assembler does indeed manipulate the timestamps, somehow setting
them to zero.
- The parsed network traffic we observe with zero timestamps is actually
`DroppedBytes`.
printer.V(6).Infof("ParsedNetworkTraffic with last packet before first packet. first: %v last: %v", firstPacketTime, lastPacketTime)
258
+
printer.V(6).Infof("ParsedNetworkTraffic with last packet before first packet. type: %v first: %v last: %v", pncType(), firstPacketTime, lastPacketTime)
0 commit comments