From Paolo Abeni:

	The attached patch fix an off by one in current usb sniffing
	code.  It also substitute the kernel-provided timestamp with
	gettimeofday.  The kernel provided timestamp use 32 bits to
	represent a struct timeval (8 bits for tv_sec and 24 for
	tv_usec), so it's content is quite misleading.

diff --git a/pcap-usb-linux.c b/pcap-usb-linux.c
index f01a28b14d0b1850360435b1c21f4698970ee7fc..29d7ba7ad2ca4d134edb48a87e3b22e0de372132 100644 (file)
--- a/pcap-usb-linux.c
+++ b/pcap-usb-linux.c
@@ -241,8 +241,15 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
        uhdr->endpoint_number = htonl(ep_num);
        uhdr->device_address = htonl(dev_addr);
        string += cnt;
        uhdr->endpoint_number = htonl(ep_num);
        uhdr->device_address = htonl(dev_addr);
        string += cnt;

-       pkth.ts.tv_sec = timestamp / 1000000;
-       pkth.ts.tv_usec = timestamp % 1000000;
+
+       /* don't use usbmon provided timestamp, since it have low precision*/
+       if (gettimeofday(&pkth.ts, NULL) < 0) 
+       {
+               snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+                       "Can't get timestamp for message '%s' %d:%s", 
+                       string, errno, strerror(errno));
+               return -1;
+       }

        
        /* parse endpoint information */
        if (pipeid1 == 'C')
        
        /* parse endpoint information */
        if (pipeid1 == 'C')


@@ -353,6 +360,9 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
        if (urb_tag != '=')
                goto got;
        
        if (urb_tag != '=')
                goto got;
        

+       /* skip urb tag and following space */
+       string += 3;
+       

        /* read all urb data; if urb length is greater then the usbmon internal 
         * buffer length used by the kernel to spool the URB, we get only
         * a partial information.
        /* read all urb data; if urb length is greater then the usbmon internal 
         * buffer length used by the kernel to spool the URB, we get only
         * a partial information.