the-tcpdump-group/tcpdump — pull request #377 by msekletar (2014-03-19 14:16:08+00:00)
Title: timestamps: make possible to request high precision timestamps

A while ago we introduced new API in libpcap which made possible to request
timestamps with higher resolution (nanosecond). This commit aims to move things
forward and implement missing bits. It introduces new option -P.

When used for live capture tcpdump we will ask kernel for timestamp resolution
in nanoseconds and tcpdump will print fraction part of the timestamp using
nanosecond format. In the future we might support even more granular timestamp
resolution, but we should be fine to support only microsecond and nanosecond
for now. libpcap doesn't provide anything else at the moment anyway.

When used in combination with -r/-w options then we will either write to the
savefile timestamps in nanoseconds or treat timestamps in savefile as if they
are in nanoseconds. If they are not we will scale them to nanoseconds.