# PCAPNG Interface Timestamp Validator

> PCAPNG Interface Timestamp Validator is a paid API for AI agents from detect.halowerk.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-21).

Validates PCAPNG packet timestamps against declared nanosecond resolution values defined in section header, interface description, and enhanced packet blocks

## Facts

- Endpoint: POST https://detect.halowerk.com/v1/integration/api-pcapng-interface-time?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pcapng-interface-timestamp-validator-607cf8fb
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_MFZqt0fFExg2uQFwt1PzJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pcapng-interface-timestamp-validator-607cf8fb -d '<json body>'
```

Example prompt: Check this PCAPNG capture file for timestamp accuracy — I need to verify the packet times in the enhanced packet blocks match the nanosecond resolution declared in the interface description and section header blocks, including section boundary length conformance.

## When to prefer this

Use this endpoint when you need to programmatically verify that PCAPNG capture files correctly declare and honor nanosecond-precision timestamps across SHB, IDB, and EPB blocks — particularly useful in forensic workflows, capture tool QA pipelines, or any situation where timestamp integrity is critical and manual inspection is impractical.

## Known failure modes

- Invalid or malformed PCAPNG contract structure returns validation error
- Section length declared in SHB does not match actual block boundary — flagged as non-conformant
- Ambiguous repeated clock options or legacy packet blocks detected — reported as unknown/unsupported
- Missing required pcap_contract field causes 400 bad request
- Timestamp resolution not parseable as exact rational nanoseconds — returns parsing failure

## How this service works

PCAPNG API packet times against declared nanosecond values

## Output

Returns a validation result indicating whether PCAPNG packet timestamps in the enhanced packet blocks conform to the nanosecond resolution and offset values declared in the section header and interface description blocks, including conformance of finite section lengths to block boundaries and any detected clock ambiguity or legacy block issues.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "artifact": {
   "type": "object",
   "required": [
    "pcap_contract"
   ],
   "properties": {
    "pcap_contract": {
     "type": "object",
     "description": "SHB/IDB/EPB only; section-local timestamp resolution and offset; reduced exact rational nanoseconds; ambiguous repeated clock options and legacy packet blocks unknown. Finite section lengths must match section boundary; SHB fixed fields including64-bit section length are read only within declared block length>=28.",
     "additionalProperties": true
    }
   },
   "additionalProperties": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pcapng-interface-timestamp-validator-607cf8fb/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from detect.halowerk.com](https://www.zero.xyz/host/detect.halowerk.com/llms.txt)