<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns:v = "urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META content=text/html;charset=Windows-1252 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16625">
<STYLE>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</STYLE>
</HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody lang=EN-US leftMargin=0 link=blue topMargin=0 bgColor=white
vLink=purple CanvasTabStop="true" name="Compose message area">
<DIV><FONT face=Calibri>He is measuring the delay between two consecutive
packets. Lack of sync between transmitter and receiver clocks would not cause
those delays.</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>GV</FONT></DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=fish@infidels.org
href="mailto:fish@infidels.org">"Fish" (David B. Trout)</A> </DIV>
<DIV><B>Sent:</B> Wednesday, September 22, 2010 3:30 AM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Subject:</B> Re: [Winpcap-users] timestamping and huge
latency</DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV class=WordSection1>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Another
thing: if the sending and receiving/capturing systems' clocks are not
synchronized with each other, then how are you measuring the supposed latency
between sending and receiving/capturing?<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">That
is to say, if the two clocks are not synchronized with one another, then normal
clock drift would completely invalidate your measured latency in my
opinion.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Are
the two system's clocks synchronized with one another?<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">If
they're not then there's your answer.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">p.s.
if/when you do synchronize them with each other, remember to ensure that either:
a) <I>neither</I> or them synchronizes with an external clock, or: b) only ONE
of them does! (but not both!) The same rule applies to the Windows Time
Service too: disable it on <I>both</I> or else ensure the one with it enabled is
configured as the "time <I>server</I>". Otherwise your results would once
again be completely invalid/inconclusive.<o:p></o:p></SPAN></P>
<DIV>
<P style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto"
class=MsoNormal><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; FONT-SIZE: 7.5pt">-- </SPAN><SPAN
style="COLOR: #1f497d"><BR></SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; FONT-SIZE: 13.5pt">
"</SPAN><B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: green">Fish</SPAN></B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; FONT-SIZE: 13.5pt">"</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; FONT-SIZE: 10pt"> (</SPAN><SPAN
style="FONT-FAMILY: 'Comic Sans MS'; COLOR: purple; FONT-SIZE: 10pt">David B.
Trout</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt">)</SPAN><SPAN
style="COLOR: #1f497d"> <BR></SPAN><SPAN
style="FONT-FAMILY: 'Verdana','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt"> </SPAN><SPAN
style="COLOR: #1f497d"> </SPAN><U><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: blue; FONT-SIZE: 10pt">fish@softdevlabs.com</SPAN></U><SPAN
style="COLOR: #1f497d"><o:p></o:p></SPAN></P></DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: blue 1.5pt solid; PADDING-BOTTOM: 0in; PADDING-LEFT: 4pt; PADDING-RIGHT: 0in; BORDER-TOP: medium none; BORDER-RIGHT: medium none; PADDING-TOP: 0in">
<DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<P class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: windowtext; FONT-SIZE: 10pt">From:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: windowtext; FONT-SIZE: 10pt">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B>On Behalf Of </B>Helmut Vaupotitsch<BR><B>Sent:</B> Tuesday, September 14,
2010 9:18 AM<BR><B>To:</B> winpcap-users@winpcap.org<BR><B>Subject:</B>
[Winpcap-users] timestamping and huge latency<BR><B>Importance:</B>
High<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal><TT><SPAN style="FONT-SIZE: 10pt">Hi Gianluca and all
others,</SPAN></TT><SPAN
style="FONT-FAMILY: 'Courier New'; FONT-SIZE: 10pt"><BR><BR><TT>I am facing a
major latency problem on *long lasting* capture sessions which maybe
</TT><BR><TT>has to do with timestamping by the driver, every hint to solve it
is appreciated:</TT><BR><BR><TT>We developed a proprietary protocol to
configure, manage and monitor </TT><BR><TT>our self-developed hardware, the
config software uses WinPCap to capture and send raw
packets.</TT><BR><BR><TT>Everything is working fine, but after some days of
continuous capturing i face:</TT><BR><TT>- On some machines, the latency between
sending requests and receiving the answer </TT><BR><TT> increases to some
seconds (can be up to >30 secs after capturing for a
week!)</TT><BR><TT>Closing and re-opening the driver would solve the problem,
but i definitely need to capture</TT><BR><TT>for months and longer without
interrupt!</TT><BR><BR><TT>I know that the driver timestamp is drifting apart
from the System Time(which can be</TT><BR><TT>synchronized by e.g. a NTP
server), therefore i timestamp the frames my myself(which </TT><BR><TT>is also
important if a use timeouts)</TT><BR><BR><TT><B>My question
is:</B></TT><B><BR><TT>What could be the reason(s) for huge latency on long
lasting captures?</TT><BR></B><TT>I know that the latency increases on receiving
packets</TT><BR><TT>Currently i donīt know if sendingīs latency also
increases</TT><BR><TT>Maybe it has something to do with the
GetSystemTimeAdjustment setting?</TT><BR></SPAN><BR><SPAN
style="FONT-FAMILY: 'Courier New'; FONT-SIZE: 10pt"><BR><TT>Thanks for
reading</TT><BR><BR><TT>Best regards from
Austria</TT><BR><TT>Helmut</TT><BR><BR></SPAN><BR>Gianluca Varenni schrieb:
<o:p></o:p></P><PRE>The return value of QuerySystemTime and QueryPerformanceCounter is <o:p></o:p></PRE><PRE>synchronized at the beginning of the capture (to compute the offset between <o:p></o:p></PRE><PRE>epoch time and QueryPerformanceCounter), and then the counter and frequency <o:p></o:p></PRE><PRE>returned by QPC are used to compute the number of seconds (and microseconds) <o:p></o:p></PRE><PRE>and added to the offset.<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>The timestamping code is available in the source code of WinPcap, <o:p></o:p></PRE><PRE>winpcap\packetntx\driver\time_calls.h<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>Have a nice day<o:p></o:p></PRE><PRE>GV<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE><o:p> </o:p></PRE><PRE><o:p> </o:p></PRE><PRE>--------------------------------------------------<o:p></o:p></PRE><PRE>From: "Jan Martinec" <A href="mailto:martij12@fel.cvut.cz"><martij12@fel.cvut.cz></A><o:p></o:p></PRE><PRE>Sent: Tuesday, September 14, 2010 7:23 AM<o:p></o:p></PRE><PRE>To: <A href="mailto:winpcap-users@winpcap.org"><winpcap-users@winpcap.org></A><o:p></o:p></PRE><PRE>Subject: [Winpcap-users] timestamp<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE> <o:p></o:p></PRE>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt"><PRE>Hello!<o:p></o:p></PRE><PRE>I've got a question about timestamping method. I know that a timestamp<o:p></o:p></PRE><PRE>is got using method QueryPerformanceCounter (resp.<o:p></o:p></PRE><PRE>keQueryPerformanceCounter), which is a number of ticks of Performance<o:p></o:p></PRE><PRE>counter. But timestamp is by Winpcap returned in "Seconds since Epoch"<o:p></o:p></PRE><PRE>format. So how is the recomputation done?<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>Thank you very much<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>Best regards,<o:p></o:p></PRE><PRE>Jan Martinec<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE><o:p> </o:p></PRE><PRE>_______________________________________________<o:p></o:p></PRE><PRE>Winpcap-users mailing list<o:p></o:p></PRE><PRE><A href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</A><o:p></o:p></PRE><PRE><A href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</A> <o:p></o:p></PRE><PRE> <o:p></o:p></PRE></BLOCKQUOTE><PRE><o:p> </o:p></PRE><PRE>_______________________________________________<o:p></o:p></PRE><PRE>Winpcap-users mailing list<o:p></o:p></PRE><PRE><A href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</A><o:p></o:p></PRE><PRE><A href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</A><o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE> <o:p></o:p></PRE>
<P class=MsoNormal><BR><BR><o:p></o:p></P><PRE>-- <o:p></o:p></PRE><PRE>----------------------------------------------------------------<o:p></o:p></PRE><PRE>Ing. Helmut Vaupotitsch Phone: +43 (0)3133 3780 16<o:p></o:p></PRE><PRE>ITEC Tontechnik und Fax: +43 (0)3133 3780 9<o:p></o:p></PRE><PRE>Industrieelektronik GmbH E-mail: <A href="mailto:hv@itec-audio.com">hv@itec-audio.com</A><o:p></o:p></PRE><PRE>A-8200 Lassnitzthal 300 URL: <A href="http://www.itec-audio.com">http://www.itec-audio.com</A><o:p></o:p></PRE><PRE>----------------------------------------------------------------<o:p></o:p></PRE></DIV></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BODY></HTML>