<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Somebody correct me if I'm wrong here....<br>
<br>
But I do believe your statement "time when packet came to computer" is wrong. It's tagged with "time when packet came to winpcap".<br>
<br>
Most OS's (all that I know of) have a TCP queue in the OS. Winpcap retrieves from that and then tags. So packets can queue up without being time tagged for a short while.<br>
<br>
What time drift are you trying to fix? Does the computer you're running winpcap on have a problem? Can't you just run NTP to fix that? It automatically adjusts for drift on your computer clock.<br>
<a href="http://www.meinberg.de/english/sw/ntp.htm#ntp_nt_stable" target="_blank">http://www.meinberg.de/english/sw/ntp.htm#ntp_nt_stable</a><br>
<br>
NTP can usually achieve 1ms accuracy so you'll be left with some jitter for "time to winpcap" which should be notably sub 1ms but at least that jitter will not be drifiting on you.<br>
<br>
<div><br>
<div style="font-family:Tahoma; font-size:13px">
<p>Michael D. Black<br>
Senior Scientist<br>
Advanced Analytics Directorate<br>
Advanced GEOINT Solutions Operating Unit<br>
Northrop Grumman Information Systems<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF991430"><font color="#000000" face="Tahoma" size="2"><b>From:</b> winpcap-users-bounces@winpcap.org [winpcap-users-bounces@winpcap.org] on behalf of Sašo Piskar [saso.piskar@dewesoft.si]<br>
<b>Sent:</b> Monday, October 08, 2012 5:20 AM<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> EXT :[Winpcap-users] Timestamping<br>
</font><br>
</div>
<div></div>
<div>Hello,
<div><br>
</div>
<div>I am writing program to sniff ethernet packets.</div>
<div>With "pcap_next_ex" I nomally get the timestamp of the packet.</div>
<div>As I understand, timestamps are calculated with queryperformancecounter in the winpcap driver.</div>
<div><br>
</div>
<div>I need to synchronize those packets to some other clock (external device) to fix time drift problem.</div>
<div>If I just use timestamp of received packet, this is actually time when packet came to computer. I would also need to get current time (as precise as possible) in order to be able to synchronize packet timestamp with external clock.</div>
<div><br>
</div>
<div>Is there any way to get current clock from winpcap driver?</div>
<div><br>
</div>
<div>Best Regards,</div>
<div>Sašo</div>
<div>
<div><br>
</div>
<br>
<br>
</div>
</div>
</div>
</div>
</body>
</html>