Although this may be wasteful in space, we chose to leave room to grow and keep trace management simple. The first field in each record is a magic word, a random 32 bit pattern that both identifies the record's type and lends some confidence that the record is well formed. We place every record's size in its second field. By comparing the size of a record to the known constraints for the record's type, we can gain further confidence that a record is well-formed. This basic record structure is illustrated in Figure 1.
All records also contain a two-word timestamp.
Only one of the two formats is used in any given trace, and the format is specified at the start of a trace file. The first word in either format is the number of seconds that have elapsed since midnight, January 1, 1970. The second word is the additional fractions of a second. In the timeval format, these fractions are expressed in microseconds, in the same way that many current operating systems express time. We've chosen these two values since they are convenient, cover most current and anticipated systems' notions of time, and offer appropriate granularity for measuring network events.