PcapFileEx.TimestampShift (pcap_file_ex v0.5.5)

View Source

Utilities for shifting packet timestamps.

Useful for:

  • Normalizing timestamps to start at epoch (for reproducible tests)
  • Anonymizing capture times
  • Aligning captures from different sources

Examples

# Normalize timestamps to start at epoch
normalized = PcapFileEx.TimestampShift.normalize_to_epoch(packets)

# Shift all timestamps by a fixed offset
shifted = PcapFileEx.TimestampShift.shift_all(packets, -3_600_000_000_000)  # -1 hour in nanos

Summary

Functions

normalize_to_epoch(packets)

Normalizes timestamps so the first packet starts at Unix epoch (1970-01-01 00:00:00 UTC).

shift_all(packets, offset_nanos)

Shifts all packet timestamps by a fixed nanosecond offset.

Functions

normalize_to_epoch(packets)

@spec normalize_to_epoch(Enumerable.t()) :: [PcapFileEx.Packet.t()]

Normalizes timestamps so the first packet starts at Unix epoch (1970-01-01 00:00:00 UTC).

Calculates the offset needed to move the first packet to epoch, then applies that offset to all packets. Preserves relative timing between packets.

Parameters

  • packets - Enumerable of packets (must have at least one packet)

Returns

  • List of packets with normalized timestamps

Examples

# Make timestamps start at epoch
normalized = PcapFileEx.TimestampShift.normalize_to_epoch(packets)

# First packet will have timestamp_precise.secs == 0
[first | _rest] = normalized
assert first.timestamp_precise.secs == 0

shift_all(packets, offset_nanos)

@spec shift_all(Enumerable.t(), integer()) :: [PcapFileEx.Packet.t()]

Shifts all packet timestamps by a fixed nanosecond offset.

Parameters

  • packets - Enumerable of packets
  • offset_nanos - Nanoseconds to add (negative to subtract)

Returns

  • List of packets with adjusted timestamps

Examples

# Shift forward by 1 second
shifted = PcapFileEx.TimestampShift.shift_all(packets, 1_000_000_000)

# Shift backward by 1 hour
shifted = PcapFileEx.TimestampShift.shift_all(packets, -3_600_000_000_000)