Lines Matching +full:high +full:- +full:resolution
21 * sf-pcapng.c - pcapng-file-format-specific code from savefile.c
26 #include <pcap/pcap-inttypes.h>
34 #include "pcap-int.h"
35 #include "pcap-util.h"
37 #include "pcap-common.h"
40 #include "os-proto.h"
43 #include "sf-pcapng.h"
97 * Byte-order magic value.
131 #define IF_TSRESOL 9 /* interface's time stamp resolution */
178 * Block cursor - used when processing the contents of a block.
197 * Per-interface information.
201 uint64_t tsresol; /* time stamp resolution */
203 uint64_t scale_factor; /* time stamp scale factor for power-of-10 tsresol */
208 * Per-pcap_t private data.
213 * link-layer header types. (Currently, we don't support IDBs with
214 * different link-layer header types, but we will support it in the
215 * future, when we offer file-reading APIs that support it.)
217 * XXX - that's an issue on ILP32 platforms, where the maximum block
218 * size of 2^31-1 would eat all but one byte of the entire address space.
221 * address bits (currently, x86-64 only supports 48 bits of address), 2)
227 uint64_t user_tsresol; /* time stamp resolution requested by the user */
242 * as the size of an EPB with a max_snaplen-sized packet and 128KB of
273 return (-1); in read_bytes()
288 ps = p->priv; in read_block()
294 if (p->swapped) { in read_block()
300 * Is this block "too small" - i.e., is it shorter than a block in read_block()
309 return (-1); in read_block()
322 return (-1); in read_block()
328 if (p->bufsize < bhdr.total_length) { in read_block()
330 * No - make it big enough, unless it's too big, in in read_block()
335 if (bhdr.total_length > ps->max_blocksize) { in read_block()
337 ps->max_blocksize); in read_block()
338 return (-1); in read_block()
340 bigger_buffer = realloc(p->buffer, bhdr.total_length); in read_block()
343 return (-1); in read_block()
345 p->buffer = bigger_buffer; in read_block()
352 memcpy(p->buffer, &bhdr, sizeof(bhdr)); in read_block()
353 bdata = (u_char *)p->buffer + sizeof(bhdr); in read_block()
354 data_remaining = bhdr.total_length - sizeof(bhdr); in read_block()
355 if (read_bytes(fp, bdata, data_remaining, 1, errbuf) == -1) in read_block()
356 return (-1); in read_block()
361 btrlr = (struct block_trailer *)(bdata + data_remaining - sizeof (struct block_trailer)); in read_block()
362 if (p->swapped) in read_block()
363 btrlr->total_length = SWAPLONG(btrlr->total_length); in read_block()
369 if (bhdr.total_length != btrlr->total_length) { in read_block()
375 return (-1); in read_block()
381 cursor->data = bdata; in read_block()
382 cursor->data_remaining = data_remaining - sizeof(struct block_trailer); in read_block()
383 cursor->block_type = bhdr.block_type; in read_block()
397 if (cursor->data_remaining < chunk_size) { in get_from_block_data()
400 cursor->block_type); in get_from_block_data()
407 data = cursor->data; in get_from_block_data()
408 cursor->data += chunk_size; in get_from_block_data()
409 cursor->data_remaining -= chunk_size; in get_from_block_data()
427 * Byte-swap it if necessary. in get_opthdr_from_block_data()
429 if (p->swapped) { in get_opthdr_from_block_data()
430 opthdr->option_code = SWAPSHORT(opthdr->option_code); in get_opthdr_from_block_data()
431 opthdr->option_length = SWAPSHORT(opthdr->option_length); in get_opthdr_from_block_data()
444 /* Pad option length to 4-byte boundary */ in get_optvalue_from_block_data()
445 padded_option_len = opthdr->option_length; in get_optvalue_from_block_data()
471 while (cursor->data_remaining != 0) { in process_idb_options()
480 return (-1); in process_idb_options()
492 return (-1); in process_idb_options()
495 switch (opthdr->option_code) { in process_idb_options()
498 if (opthdr->option_length != 0) { in process_idb_options()
501 opthdr->option_length); in process_idb_options()
502 return (-1); in process_idb_options()
507 if (opthdr->option_length != 1) { in process_idb_options()
510 opthdr->option_length); in process_idb_options()
511 return (-1); in process_idb_options()
516 return (-1); in process_idb_options()
522 * Resolution is negative power of 2. in process_idb_options()
528 * Resolution is too high; 2^-{res} in process_idb_options()
529 * won't fit in a 64-bit value. in process_idb_options()
532 "Interface Description Block if_tsresol option resolution 2^-%u is too high", in process_idb_options()
534 return (-1); in process_idb_options()
540 * Resolution is negative power of 10. in process_idb_options()
544 * Resolution is too high; 2^-{res} in process_idb_options()
545 * won't fit in a 64-bit value (the in process_idb_options()
547 * in a 64-bit value is 10^19, as in process_idb_options()
548 * the largest 64-bit unsigned in process_idb_options()
552 "Interface Description Block if_tsresol option resolution 10^-%u is too high", in process_idb_options()
554 return (-1); in process_idb_options()
564 if (opthdr->option_length != 8) { in process_idb_options()
567 opthdr->option_length); in process_idb_options()
568 return (-1); in process_idb_options()
573 return (-1); in process_idb_options()
577 if (p->swapped) in process_idb_options()
599 ps = p->priv; in add_interface()
604 ps->ifcount++; in add_interface()
607 * Grow the array of per-interface information as necessary. in add_interface()
609 if (ps->ifcount > ps->ifaces_size) { in add_interface()
616 if (ps->ifaces_size == 0) { in add_interface()
622 * ps->ifaces_size == 0 if ps->ifaces == NULL, in add_interface()
642 if (ps->ifaces_size * 2 < ps->ifaces_size) { in add_interface()
645 * ps->ifaces_size overflows is the largest in add_interface()
646 * possible 32-bit power of 2, as we do in add_interface()
656 * ps->ifaces_size * 2 doesn't overflow, so it's in add_interface()
659 new_ifaces_size = ps->ifaces_size * 2; in add_interface()
665 * That can happen on 32-bit platforms, with a 32-bit in add_interface()
666 * size_t; it shouldn't happen on 64-bit platforms, in add_interface()
667 * with a 64-bit size_t, as new_ifaces_size is in add_interface()
672 * As this fails only with 32-bit size_t, in add_interface()
673 * the multiplication was 32x32->32, and in add_interface()
674 * the largest 32-bit value that can safely in add_interface()
676 * without overflow is the largest 32-bit in add_interface()
685 new_ifaces = realloc(ps->ifaces, new_ifaces_size * sizeof (struct pcap_ng_if)); in add_interface()
693 "out of memory for per-interface information (%u interfaces)", in add_interface()
694 ps->ifcount); in add_interface()
697 ps->ifaces_size = new_ifaces_size; in add_interface()
698 ps->ifaces = new_ifaces; in add_interface()
701 ps->ifaces[ps->ifcount - 1].snaplen = idbp->snaplen; in add_interface()
704 * Set the default time stamp resolution and offset. in add_interface()
706 tsresol = 1000000; /* microsecond resolution */ in add_interface()
715 errbuf) == -1) in add_interface()
718 ps->ifaces[ps->ifcount - 1].tsresol = tsresol; in add_interface()
719 ps->ifaces[ps->ifcount - 1].tsoffset = tsoffset; in add_interface()
725 if (tsresol == ps->user_tsresol) { in add_interface()
727 * The resolution is the resolution the user wants, in add_interface()
730 ps->ifaces[ps->ifcount - 1].scale_type = PASS_THROUGH; in add_interface()
731 } else if (tsresol > ps->user_tsresol) { in add_interface()
733 * The resolution is greater than what the user wants, in add_interface()
737 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_BIN; in add_interface()
742 ps->ifaces[ps->ifcount - 1].scale_factor = tsresol/ps->user_tsresol; in add_interface()
743 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_DEC; in add_interface()
747 * The resolution is less than what the user wants, in add_interface()
751 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_BIN; in add_interface()
756 ps->ifaces[ps->ifcount - 1].scale_factor = ps->user_tsresol/tsresol; in add_interface()
757 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_DEC; in add_interface()
796 * XXX - check whether this looks like what the block in pcap_ng_check_header()
799 * does, look for the byte-order magic number in in pcap_ng_check_header()
815 * fixed-length portion of the SHB, and look for the byte-order in pcap_ng_check_header()
885 p->swapped = swapped; in pcap_ng_check_header()
886 ps = p->priv; in pcap_ng_check_header()
894 ps->user_tsresol = 1000000; in pcap_ng_check_header()
898 ps->user_tsresol = 1000000000; in pcap_ng_check_header()
903 "unknown time stamp resolution %u", precision); in pcap_ng_check_header()
909 p->opt.tstamp_precision = precision; in pcap_ng_check_header()
918 * Packet Block containing a full-size Ethernet frame, and in pcap_ng_check_header()
923 * INITIAL_MAX_BLOCKSIZE; if we see any link-layer header types in pcap_ng_check_header()
927 p->bufsize = 2048; in pcap_ng_check_header()
928 if (p->bufsize < total_length) in pcap_ng_check_header()
929 p->bufsize = total_length; in pcap_ng_check_header()
930 p->buffer = malloc(p->bufsize); in pcap_ng_check_header()
931 if (p->buffer == NULL) { in pcap_ng_check_header()
937 ps->max_blocksize = INITIAL_MAX_BLOCKSIZE; in pcap_ng_check_header()
943 bhdrp = (struct block_header *)p->buffer; in pcap_ng_check_header()
944 shbp = (struct section_header_block *)((u_char *)p->buffer + sizeof(struct block_header)); in pcap_ng_check_header()
945 bhdrp->block_type = magic_int; in pcap_ng_check_header()
946 bhdrp->total_length = total_length; in pcap_ng_check_header()
947 shbp->byte_order_magic = byte_order_magic; in pcap_ng_check_header()
949 (u_char *)p->buffer + (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)), in pcap_ng_check_header()
950 total_length - (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)), in pcap_ng_check_header()
951 1, errbuf) == -1) in pcap_ng_check_header()
954 if (p->swapped) { in pcap_ng_check_header()
956 * Byte-swap the fields we've read. in pcap_ng_check_header()
958 shbp->major_version = SWAPSHORT(shbp->major_version); in pcap_ng_check_header()
959 shbp->minor_version = SWAPSHORT(shbp->minor_version); in pcap_ng_check_header()
962 * XXX - we don't care about the section length. in pcap_ng_check_header()
974 XXX - the pcapng specification says that readers should in pcap_ng_check_header()
979 if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR && in pcap_ng_check_header()
980 (shbp->minor_version == PCAP_NG_VERSION_MINOR || in pcap_ng_check_header()
981 shbp->minor_version == 2))) { in pcap_ng_check_header()
984 shbp->major_version, shbp->minor_version); in pcap_ng_check_header()
987 p->version_major = shbp->major_version; in pcap_ng_check_header()
988 p->version_minor = shbp->minor_version; in pcap_ng_check_header()
991 * Save the time stamp resolution the user requested. in pcap_ng_check_header()
993 p->opt.tstamp_precision = precision; in pcap_ng_check_header()
1004 /* EOF - no IDB in this file */ in pcap_ng_check_header()
1009 if (status == -1) in pcap_ng_check_header()
1015 * Get a pointer to the fixed-length portion of the in pcap_ng_check_header()
1024 * Byte-swap it if necessary. in pcap_ng_check_header()
1026 if (p->swapped) { in pcap_ng_check_header()
1027 idbp->linktype = SWAPSHORT(idbp->linktype); in pcap_ng_check_header()
1028 idbp->snaplen = SWAPLONG(idbp->snaplen); in pcap_ng_check_header()
1044 * not valid, as we don't know what link-layer in pcap_ng_check_header()
1060 p->linktype = linktype_to_dlt(idbp->linktype); in pcap_ng_check_header()
1061 p->snapshot = pcapint_adjust_snapshot(p->linktype, idbp->snaplen); in pcap_ng_check_header()
1062 p->linktype_ext = 0; in pcap_ng_check_header()
1069 if (MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)) > ps->max_blocksize) in pcap_ng_check_header()
1070 ps->max_blocksize = MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)); in pcap_ng_check_header()
1072 p->next_packet_op = pcap_ng_next_packet; in pcap_ng_check_header()
1073 p->cleanup_op = pcap_ng_cleanup; in pcap_ng_check_header()
1078 free(ps->ifaces); in pcap_ng_check_header()
1079 free(p->buffer); in pcap_ng_check_header()
1088 struct pcap_ng_sf *ps = p->priv; in pcap_ng_cleanup()
1090 free(ps->ifaces); in pcap_ng_cleanup()
1097 * if there were no more packets, and -1 on an error.
1102 struct pcap_ng_sf *ps = p->priv; in pcap_ng_next_packet()
1111 FILE *fp = p->rfile; in pcap_ng_next_packet()
1123 status = read_block(fp, p, &cursor, p->errbuf); in pcap_ng_next_packet()
1126 if (status == -1) in pcap_ng_next_packet()
1127 return (-1); /* error */ in pcap_ng_next_packet()
1132 * Get a pointer to the fixed-length portion of the in pcap_ng_next_packet()
1136 p->errbuf); in pcap_ng_next_packet()
1138 return (-1); /* error */ in pcap_ng_next_packet()
1141 * Byte-swap it if necessary. in pcap_ng_next_packet()
1143 if (p->swapped) { in pcap_ng_next_packet()
1145 interface_id = SWAPLONG(epbp->interface_id); in pcap_ng_next_packet()
1146 hdr->caplen = SWAPLONG(epbp->caplen); in pcap_ng_next_packet()
1147 hdr->len = SWAPLONG(epbp->len); in pcap_ng_next_packet()
1148 t = ((uint64_t)SWAPLONG(epbp->timestamp_high)) << 32 | in pcap_ng_next_packet()
1149 SWAPLONG(epbp->timestamp_low); in pcap_ng_next_packet()
1151 interface_id = epbp->interface_id; in pcap_ng_next_packet()
1152 hdr->caplen = epbp->caplen; in pcap_ng_next_packet()
1153 hdr->len = epbp->len; in pcap_ng_next_packet()
1154 t = ((uint64_t)epbp->timestamp_high) << 32 | in pcap_ng_next_packet()
1155 epbp->timestamp_low; in pcap_ng_next_packet()
1161 * Get a pointer to the fixed-length portion of the in pcap_ng_next_packet()
1165 p->errbuf); in pcap_ng_next_packet()
1167 return (-1); /* error */ in pcap_ng_next_packet()
1176 * Byte-swap it if necessary. in pcap_ng_next_packet()
1178 if (p->swapped) { in pcap_ng_next_packet()
1180 hdr->len = SWAPLONG(spbp->len); in pcap_ng_next_packet()
1182 hdr->len = spbp->len; in pcap_ng_next_packet()
1189 hdr->caplen = hdr->len; in pcap_ng_next_packet()
1190 if (hdr->caplen > (bpf_u_int32)p->snapshot) in pcap_ng_next_packet()
1191 hdr->caplen = p->snapshot; in pcap_ng_next_packet()
1197 * Get a pointer to the fixed-length portion of the in pcap_ng_next_packet()
1201 p->errbuf); in pcap_ng_next_packet()
1203 return (-1); /* error */ in pcap_ng_next_packet()
1206 * Byte-swap it if necessary. in pcap_ng_next_packet()
1208 if (p->swapped) { in pcap_ng_next_packet()
1210 interface_id = SWAPSHORT(pbp->interface_id); in pcap_ng_next_packet()
1211 hdr->caplen = SWAPLONG(pbp->caplen); in pcap_ng_next_packet()
1212 hdr->len = SWAPLONG(pbp->len); in pcap_ng_next_packet()
1213 t = ((uint64_t)SWAPLONG(pbp->timestamp_high)) << 32 | in pcap_ng_next_packet()
1214 SWAPLONG(pbp->timestamp_low); in pcap_ng_next_packet()
1216 interface_id = pbp->interface_id; in pcap_ng_next_packet()
1217 hdr->caplen = pbp->caplen; in pcap_ng_next_packet()
1218 hdr->len = pbp->len; in pcap_ng_next_packet()
1219 t = ((uint64_t)pbp->timestamp_high) << 32 | in pcap_ng_next_packet()
1220 pbp->timestamp_low; in pcap_ng_next_packet()
1227 * to its fixed-length portion. in pcap_ng_next_packet()
1230 p->errbuf); in pcap_ng_next_packet()
1232 return (-1); /* error */ in pcap_ng_next_packet()
1235 * Byte-swap it if necessary. in pcap_ng_next_packet()
1237 if (p->swapped) { in pcap_ng_next_packet()
1238 idbp->linktype = SWAPSHORT(idbp->linktype); in pcap_ng_next_packet()
1239 idbp->snaplen = SWAPLONG(idbp->snaplen); in pcap_ng_next_packet()
1243 * If the link-layer type or snapshot length in pcap_ng_next_packet()
1247 * XXX - just discard packets from those in pcap_ng_next_packet()
1250 if (p->linktype != idbp->linktype) { in pcap_ng_next_packet()
1251 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1253 idbp->linktype); in pcap_ng_next_packet()
1254 return (-1); in pcap_ng_next_packet()
1261 if ((bpf_u_int32)p->snapshot != in pcap_ng_next_packet()
1262 pcapint_adjust_snapshot(p->linktype, idbp->snaplen)) { in pcap_ng_next_packet()
1263 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1265 idbp->snaplen); in pcap_ng_next_packet()
1266 return (-1); in pcap_ng_next_packet()
1272 if (!add_interface(p, idbp, &cursor, p->errbuf)) in pcap_ng_next_packet()
1273 return (-1); in pcap_ng_next_packet()
1279 * to its fixed-length portion. in pcap_ng_next_packet()
1282 p->errbuf); in pcap_ng_next_packet()
1284 return (-1); /* error */ in pcap_ng_next_packet()
1291 if (p->swapped) { in pcap_ng_next_packet()
1292 shbp->byte_order_magic = in pcap_ng_next_packet()
1293 SWAPLONG(shbp->byte_order_magic); in pcap_ng_next_packet()
1294 shbp->major_version = in pcap_ng_next_packet()
1295 SWAPSHORT(shbp->major_version); in pcap_ng_next_packet()
1303 switch (shbp->byte_order_magic) { in pcap_ng_next_packet()
1315 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1317 return (-1); in pcap_ng_next_packet()
1323 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1325 return (-1); in pcap_ng_next_packet()
1332 if (shbp->major_version != PCAP_NG_VERSION_MAJOR) { in pcap_ng_next_packet()
1333 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1335 shbp->major_version); in pcap_ng_next_packet()
1336 return (-1); in pcap_ng_next_packet()
1343 * length, or resolution as the first interface in pcap_ng_next_packet()
1348 ps->ifcount = 0; in pcap_ng_next_packet()
1363 if (interface_id >= ps->ifcount) { in pcap_ng_next_packet()
1367 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1370 return (-1); in pcap_ng_next_packet()
1373 if (hdr->caplen > (bpf_u_int32)p->snapshot) { in pcap_ng_next_packet()
1374 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in pcap_ng_next_packet()
1376 "snaplen of %d", hdr->caplen, p->snapshot); in pcap_ng_next_packet()
1377 return (-1); in pcap_ng_next_packet()
1382 * with the fractions being in units of the file-supplied resolution. in pcap_ng_next_packet()
1384 sec = t / ps->ifaces[interface_id].tsresol + ps->ifaces[interface_id].tsoffset; in pcap_ng_next_packet()
1385 frac = t % ps->ifaces[interface_id].tsresol; in pcap_ng_next_packet()
1388 * Convert the fractions from units of the file-supplied resolution in pcap_ng_next_packet()
1389 * to units of the user-requested resolution. in pcap_ng_next_packet()
1391 switch (ps->ifaces[interface_id].scale_type) { in pcap_ng_next_packet()
1395 * The interface resolution is what the user wants, in pcap_ng_next_packet()
1402 * The interface resolution is less than what the user in pcap_ng_next_packet()
1404 * the resolution the user requested by multiplying by in pcap_ng_next_packet()
1405 * the quotient of the user-requested resolution and the in pcap_ng_next_packet()
1406 * file-supplied resolution. in pcap_ng_next_packet()
1408 * Those resolutions are both powers of 10, and the user- in pcap_ng_next_packet()
1409 * requested resolution is greater than the file-supplied in pcap_ng_next_packet()
1410 * resolution, so the quotient in question is an integer. in pcap_ng_next_packet()
1414 frac *= ps->ifaces[interface_id].scale_factor; in pcap_ng_next_packet()
1419 * The interface resolution is less than what the user in pcap_ng_next_packet()
1421 * the resolution the user requested by multiplying by in pcap_ng_next_packet()
1422 * the quotient of the user-requested resolution and the in pcap_ng_next_packet()
1423 * file-supplied resolution. in pcap_ng_next_packet()
1425 * The file-supplied resolution is a power of 2, so the in pcap_ng_next_packet()
1428 * user-requested resolution and divide by the file- in pcap_ng_next_packet()
1429 * supplied resolution. in pcap_ng_next_packet()
1431 * XXX - Is there something clever we could do here, in pcap_ng_next_packet()
1432 * given that we know that the file-supplied resolution in pcap_ng_next_packet()
1435 * two non-simple arithmetic operations. in pcap_ng_next_packet()
1437 frac *= ps->user_tsresol; in pcap_ng_next_packet()
1438 frac /= ps->ifaces[interface_id].tsresol; in pcap_ng_next_packet()
1443 * The interface resolution is greater than what the user in pcap_ng_next_packet()
1445 * the resolution the user requested by multiplying by in pcap_ng_next_packet()
1446 * the quotient of the user-requested resolution and the in pcap_ng_next_packet()
1447 * file-supplied resolution. in pcap_ng_next_packet()
1449 * Those resolutions are both powers of 10, and the user- in pcap_ng_next_packet()
1450 * requested resolution is less than the file-supplied in pcap_ng_next_packet()
1451 * resolution, so the quotient in question isn't an in pcap_ng_next_packet()
1457 frac /= ps->ifaces[interface_id].scale_factor; in pcap_ng_next_packet()
1463 * The interface resolution is greater than what the user in pcap_ng_next_packet()
1465 * resolution the user requested by multiplying by the in pcap_ng_next_packet()
1466 * quotient of the user-requested resolution and the in pcap_ng_next_packet()
1467 * file-supplied resolution. We do that by multiplying in pcap_ng_next_packet()
1468 * by the user-requested resolution and dividing by the in pcap_ng_next_packet()
1469 * file-supplied resolution, as the quotient might not in pcap_ng_next_packet()
1472 * The file-supplied resolution is a power of 2, so the in pcap_ng_next_packet()
1475 * integer arithmetic, we multiply by the user-requested in pcap_ng_next_packet()
1476 * resolution and divide by the file-supplied resolution. in pcap_ng_next_packet()
1478 * XXX - Is there something clever we could do here, in pcap_ng_next_packet()
1479 * given that we know that the file-supplied resolution in pcap_ng_next_packet()
1482 * two non-simple arithmetic operations. in pcap_ng_next_packet()
1484 frac *= ps->user_tsresol; in pcap_ng_next_packet()
1485 frac /= ps->ifaces[interface_id].tsresol; in pcap_ng_next_packet()
1493 hdr->ts.tv_sec = (long)sec; in pcap_ng_next_packet()
1494 hdr->ts.tv_usec = (long)frac; in pcap_ng_next_packet()
1499 * UNIX Standard specify - but not all older UN*Xes necessarily in pcap_ng_next_packet()
1502 hdr->ts.tv_sec = (time_t)sec; in pcap_ng_next_packet()
1503 hdr->ts.tv_usec = (int)frac; in pcap_ng_next_packet()
1509 *data = get_from_block_data(&cursor, hdr->caplen, p->errbuf); in pcap_ng_next_packet()
1511 return (-1); in pcap_ng_next_packet()
1513 pcapint_post_process(p->linktype, p->swapped, hdr, *data); in pcap_ng_next_packet()