You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@drill.apache.org by Giovanni Conte <gi...@gmail.com> on 2019/02/20 10:39:40 UTC
Query Timestamps in microseconds from pcap
Hi,
I would like to do the timestamps difference of packet captures (pcap). The
problem is that, when i do:
drill:zk=local> SELECT `timestamp` FROM dfs.root.`/capture_file.pcap`;
i get (showing the first 2 rows)
| 2019-01-30 05:00:00.207 |
| 2019-01-30 05:00:00.207 |
We can see milliseconds accuracy.
On wireshark, the timestamps are:
2019-01-30 05:00:00.207*239*
2019-01-30 05:00:00.207*243*
and so microseconds accuracy.
I tried so to change the timestamp format from "default" to "yyyy-MM-dd
HH:mm:ss.SSSSSS" with the commad:
jdbc:drill:zk=local> !set timestampformat "yyyy-MM-dd HH:mm:ss.SSSSSS"
Now, when I query I get:
| 2019-01-23 05:00:00.000207 |
| 2019-01-23 05:00:00.000207 |
and instead of taking the *second triple*, i.e. the microseconds *239* and
*243*, it is shifting the milliseconds at the microsecons position.
Thus, the simple question is: how can I get microsecond (or more) accurancy
within a pcap query?
Thank you very much,
Giovanni
Re: Query Timestamps in microseconds from pcap
Posted by Angelo Mantellini <am...@gmail.com>.
Interesting question,
I have the same problem,
I hope you can find a solution.
Angelo
On 20/02/2019, 11:39, "Giovanni Conte" <gi...@gmail.com> wrote:
Hi,
I would like to do the timestamps difference of packet captures (pcap). The
problem is that, when i do:
drill:zk=local> SELECT `timestamp` FROM dfs.root.`/capture_file.pcap`;
i get (showing the first 2 rows)
| 2019-01-30 05:00:00.207 |
| 2019-01-30 05:00:00.207 |
We can see milliseconds accuracy.
On wireshark, the timestamps are:
2019-01-30 05:00:00.207*239*
2019-01-30 05:00:00.207*243*
and so microseconds accuracy.
I tried so to change the timestamp format from "default" to "yyyy-MM-dd
HH:mm:ss.SSSSSS" with the commad:
jdbc:drill:zk=local> !set timestampformat "yyyy-MM-dd HH:mm:ss.SSSSSS"
Now, when I query I get:
| 2019-01-23 05:00:00.000207 |
| 2019-01-23 05:00:00.000207 |
and instead of taking the *second triple*, i.e. the microseconds *239* and
*243*, it is shifting the milliseconds at the microsecons position.
Thus, the simple question is: how can I get microsecond (or more) accurancy
within a pcap query?
Thank you very much,
Giovanni