{"action":"created","issue":{"url":"https://api.github.com/repos/seladb/PcapPlusPlus/issues/127","repository_url":"https://api.github.com/repos/seladb/PcapPlusPlus","labels_url":"https://api.github.com/repos/seladb/PcapPlusPlus/issues/127/labels{/name}","comments_url":"https://api.github.com/repos/seladb/PcapPlusPlus/issues/127/comments","events_url":"https://api.github.com/repos/seladb/PcapPlusPlus/issues/127/events","html_url":"https://github.com/seladb/PcapPlusPlus/issues/127","id":348767165,"node_id":"MDU6SXNzdWUzNDg3NjcxNjU=","number":127,"title":"TcpReassembly Duration Metadata (RawPacket Timestamp Issues)","user":{"login":"Nostrademous","id":1735956,"node_id":"MDQ6VXNlcjE3MzU5NTY=","avatar_url":"https://avatars3.githubusercontent.com/u/1735956?v=4","gravatar_id":"","url":"https://api.github.com/users/Nostrademous","html_url":"https://github.com/Nostrademous","followers_url":"https://api.github.com/users/Nostrademous/followers","following_url":"https://api.github.com/users/Nostrademous/following{/other_user}","gists_url":"https://api.github.com/users/Nostrademous/gists{/gist_id}","starred_url":"https://api.github.com/users/Nostrademous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nostrademous/subscriptions","organizations_url":"https://api.github.com/users/Nostrademous/orgs","repos_url":"https://api.github.com/users/Nostrademous/repos","events_url":"https://api.github.com/users/Nostrademous/events{/privacy}","received_events_url":"https://api.github.com/users/Nostrademous/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-08T15:04:51Z","updated_at":"2018-08-08T16:37:13Z","closed_at":"2018-08-08T16:37:13Z","author_association":"NONE","body":"Hi,\r\n\r\nI was playing with your code and added tracking of the startTime and endTime (as timeval structures) in the metadata aggregator when reconstructing a TCP session/flow; however, I'm getting strange looking timestamps (both the start and end times are off).\r\n\r\nExample:\r\n```\r\nMacBook-Pro$ cat Output/192.168.1.100.40228-173.194.191.167.443-metadata.txt \r\nNumber of data packets in side 0:  3\r\nNumber of data packets in side 1:  6\r\nTotal number of data packets:      9\r\n\r\nNumber of bytes in side 0:         862\r\nNumber of bytes in side 1:         5403\r\nTotal number of bytes:             6265\r\n\r\nNumber of messages in side 0:      3\r\nNumber of messages in side 1:      3\r\n\r\nStart time of messages:            1970-01-01 01:25:20.1519860376\r\nEnd time of messages:              2108-11-19 19:24:48.335617808\r\n\r\n\r\nMacBook-Pro$ cat Output/192.168.1.100.55376-172.217.12.238.443-metadata.txt \r\nNumber of data packets in side 0:  2\r\nNumber of data packets in side 1:  6\r\nTotal number of data packets:      8\r\n\r\nNumber of bytes in side 0:         461\r\nNumber of bytes in side 1:         4760\r\nTotal number of bytes:             5221\r\n\r\nNumber of messages in side 0:      2\r\nNumber of messages in side 1:      2\r\n\r\nStart time of messages:            1970-01-01 04:16:00.1519860376\r\nEnd time of messages:              4461675-07-11 22:43:12.299293760\r\n```\r\n\r\nThe PCAP being read offline was captured on a 64-bit system so I'm wondering if there is a bug somewhere that can explain the strange looking timestamps.\r\n\r\nThe print method I use is below:\r\n```\r\nstatic std::string getPacketTimestamp(const timeval ts, bool timeAsLocalTime=false) {\r\n    // convert raw packet timestamp to printable format\r\n    time_t nowtime = ts.tv_sec;\r\n    struct tm *nowtm = NULL;\r\n    if (timeAsLocalTime)\r\n        nowtm = localtime(&nowtime);\r\n    else\r\n        nowtm = gmtime(&nowtime);\r\n\r\n    char tmbuf[64], buf[64];\r\n    if (nowtm != NULL)\r\n    {   \r\n        strftime(tmbuf, sizeof(tmbuf), \"%Y-%m-%d %H:%M:%S\", nowtm);\r\n        snprintf(buf, sizeof(buf), \"%s.%06lu\", tmbuf, ts.tv_usec);\r\n    }   \r\n    else\r\n        snprintf(buf, sizeof(buf), \"0000-00-00 00:00:00.000000\");\r\n    return std::string(buf);\r\n}\r\n```\r\n\r\nWhat I did to get the data is in the following:\r\n```\r\nMacBook-Pro:$ git diff\r\ndiff --git a/Packet++/header/TcpReassembly.h b/Packet++/header/TcpReassembly.h\r\nindex 62d97d1..d8f6927 100644\r\n--- a/Packet++/header/TcpReassembly.h\r\n+++ b/Packet++/header/TcpReassembly.h\r\n@@ -71,11 +71,16 @@ struct ConnectionData\r\n        size_t dstPort;\r\n        /** A 4-byte hash key representing the connection */\r\n        uint32_t flowKey;\r\n+    \r\n+    /** Start TimeStamp of the connection */\r\n+    timeval startTime;\r\n+    /** End TimeStamp of the connection */\r\n+    timeval endTime;\r\n \r\n        /**\r\n         * A c'tor for this struct that basically zeros all members\r\n         */\r\n-       ConnectionData() : srcIP(NULL), dstIP(NULL), srcPort(0), dstPort(0), flowKey(0) {}\r\n+       ConnectionData() : srcIP(NULL), dstIP(NULL), srcPort(0), dstPort(0), flowKey(0), startTime((struct timeval){0}), endTime((struct timeval){0}) {}\r\n \r\n        /**\r\n         * A d'tor for this strcut. Notice it frees the memory of srcIP and dstIP members\r\n@@ -104,6 +109,18 @@ struct ConnectionData\r\n         */\r\n        void setDstIpAddress(const IPAddress* destIP) { dstIP = destIP->clone(); }\r\n \r\n+    /**\r\n+     * Set startTime of Connection\r\n+     * @param[in] startTime integer value\r\n+     */\r\n+    void setStartTime(const timeval st) { startTime.tv_sec = st.tv_sec; startTime.tv_usec = st.tv_usec; }\r\n+\r\n+    /**\r\n+     * Set endTime of Connection\r\n+     * @param[in] endTime integer value\r\n+     */\r\n+    void setEndTime(const timeval et) { endTime.tv_sec = et.tv_sec; endTime.tv_usec = et.tv_usec; }\r\n+\r\n private:\r\n \r\n        void copyData(const ConnectionData& other);\r\ndiff --git a/Packet++/src/RawPacket.cpp b/Packet++/src/RawPacket.cpp\r\nindex 3af205c..bd57d07 100644\r\n--- a/Packet++/src/RawPacket.cpp\r\n+++ b/Packet++/src/RawPacket.cpp\r\n@@ -86,7 +86,8 @@ bool RawPacket::setRawData(const uint8_t* pRawData, int rawDataLen, timeval time\r\n \r\n        m_pRawData = (uint8_t*)pRawData;\r\n        m_RawDataLen = rawDataLen;\r\n-       m_TimeStamp = timestamp;\r\n+       m_TimeStamp.tv_sec = timestamp.tv_sec;\r\n+    m_TimeStamp.tv_usec = timestamp.tv_usec;\r\n        m_RawPacketSet = true;\r\n        m_linkLayerType = layerType;\r\n        return true;\r\n@@ -131,6 +132,7 @@ void RawPacket::clear()\r\n        m_RawDataLen = 0;\r\n        m_FrameLength = 0;\r\n        m_RawPacketSet = false;\r\n+    m_TimeStamp = (struct timeval){0};\r\n }\r\n \r\n void RawPacket::appendData(const uint8_t* dataToAppend, size_t dataToAppendLen)\r\ndiff --git a/Packet++/src/TcpReassembly.cpp b/Packet++/src/TcpReassembly.cpp\r\nindex 77ab6b1..62978d9 100644\r\n--- a/Packet++/src/TcpReassembly.cpp\r\n+++ b/Packet++/src/TcpReassembly.cpp\r\n@@ -238,6 +238,7 @@ void TcpReassembly::reassemblePacket(Packet& tcpData)\r\n                tcpReassemblyData->connData.srcPort = ntohs(tcpLayer->getTcpHeader()->portSrc);\r\n                tcpReassemblyData->connData.dstPort = ntohs(tcpLayer->getTcpHeader()->portDst);\r\n                tcpReassemblyData->connData.flowKey = flowKey;\r\n+        tcpReassemblyData->connData.setStartTime(tcpData.getRawPacket()->getPacketTimeStamp());\r\n \r\n                m_ConnectionList[flowKey] = tcpReassemblyData;\r\n \r\n@@ -248,7 +249,18 @@ void TcpReassembly::reassemblePacket(Packet& tcpData)\r\n                        m_OnConnStart(tcpReassemblyData->connData, m_UserCookie);\r\n        }\r\n        else // connection already exists\r\n+     {\r\n                tcpReassemblyData = iter->second;\r\n+              timeval currTime = tcpData.getRawPacket()->getPacketTimeStamp();\r\n+              if (currTime.tv_sec > tcpReassemblyData->connData.endTime.tv_sec) {\r\n+                  tcpReassemblyData->connData.setEndTime(currTime);\r\n+              }\r\n+              else if (currTime.tv_sec == tcpReassemblyData->connData.endTime.tv_sec) {\r\n+                  if (currTime.tv_usec < tcpReassemblyData->connData.endTime.tv_usec) {\r\n+                      tcpReassemblyData->connData.setEndTime(currTime);\r\n+                  }\r\n+             }\r\n+     }\r\n```"},"comment":{"url":"https://api.github.com/repos/seladb/PcapPlusPlus/issues/comments/411471285","html_url":"https://github.com/seladb/PcapPlusPlus/issues/127#issuecomment-411471285","issue_url":"https://api.github.com/repos/seladb/PcapPlusPlus/issues/127","id":411471285,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTQ3MTI4NQ==","user":{"login":"Nostrademous","id":1735956,"node_id":"MDQ6VXNlcjE3MzU5NTY=","avatar_url":"https://avatars3.githubusercontent.com/u/1735956?v=4","gravatar_id":"","url":"https://api.github.com/users/Nostrademous","html_url":"https://github.com/Nostrademous","followers_url":"https://api.github.com/users/Nostrademous/followers","following_url":"https://api.github.com/users/Nostrademous/following{/other_user}","gists_url":"https://api.github.com/users/Nostrademous/gists{/gist_id}","starred_url":"https://api.github.com/users/Nostrademous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nostrademous/subscriptions","organizations_url":"https://api.github.com/users/Nostrademous/orgs","repos_url":"https://api.github.com/users/Nostrademous/repos","events_url":"https://api.github.com/users/Nostrademous/events{/privacy}","received_events_url":"https://api.github.com/users/Nostrademous/received_events","type":"User","site_admin":false},"created_at":"2018-08-08T16:37:13Z","updated_at":"2018-08-08T16:37:13Z","author_association":"NONE","body":"Nevermind, it was my issue. I forgot to add the populated timestamps into the ConnectionData().copyData() function."}}
{"actor":{"display_login":"Nostrademous"}}