Question regarding the drop of nanosecond precision timestamp

[Teles1]

The nanosecond precision is lost while re-assembling a TCP stream. I needed to know the timestamp for when a portion of a given stream arrived and unfortunately the precision was lost. Was this a design decision or if a pull request comes in to change this to timespec for example would it get merged in? Thanks

PcapPlusPlus/Packet++/src/TcpReassembly.cpp

Line 29 in 666e292

TIMESPEC_TO_TIMEVAL(&out, &in);

[seladb]

Hi @Teles1 ! I found the commit where it was changed: 2583f64#diff-654f2a86f6954fcb6e711df2d4550f16028c3f79c08b2a7bc851dfa227dc37d2

As you can see, it was added when the packet timestamp became more accurate and changed from timeval to timespec. I assume we didn't want to change the ConnectionData and TcpStreamData structs and keep them backward compatible so we decided to just convert timespec back to timeval.

However, I think it can be a nice change to deprecate timeval and move to a struct with higher precision. It can be either timespec or a more C++11-style structure like std::chrono::time_point.

In order to stay backward compatible I'd keep the timeval properties in ConnectionData and TcpStreamData, mark them as deprecated and add new timespec / std::chrono::time_point properties. In the next version we can remove the timeval properties completely.

Would you consider implementing this change?

[Teles1]

Sure. Will do.

Edit: I mean, I'll definitively give it a shot 👍 I don't know exactly the ins and outs of the tcp protocol but looking at the implementation it doesn't look that will matter all that much.