[ntar-workers] Timestamp resolution: if_tsaccur option unclear!

[Ulf Lamping]

Hi List!

I'm currently looking for a way to bring nanosecond timestamp resolution to Ethereal. Unfortunately this is urgent, so I cannot wait until the NTAR lib is integrated into Ethereal. To achieve this goal I'm planning to use a new libpcap DLT_ value and simply put nanosecond resolution into the microsecond timestamp field.

As I don't want to reinvent the wheel, I had a look at how the timestamp resolution is specificated in the new PCAP file format and simply use as much as possible of this spec.


IMHO I've found a bug in the format specification: http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html. 

The description of the if_tsaccur option of the "3.2 Interface Description Block (mandatory)":

To qoute: "Precision of timestamps. If the Most Significant Bit is equal to zero, the remaining bits indicates the accuracy as as a negative power of 10 (e.g. 6 means microsecond accuracy). If the Most Significant Bit is equal to zero, the remaining bits indicates the accuracy as as negative power of 2 (e.g. 10 means 1/1024 of second). If this option is not present, a precision of 10^-6 is assumed."

Well, both sentences starts with the identical: "If the Most Significant Bit is equal to zero"?!? One of the sentences should include one and not zero :-)

Could you tell me the correct way and update the spec accordingly?

BTW: The starting sentence "Precision of timestamps" is a bit misleading, as the if_tsaccur option will only affect the lower 32 bit part of the timestamp, according to the packet block format description. "Precision of Timestamp (Low)" might be better.


Please CC me, as I'm currently not on this list...

Regards, ULFL

P.S: With the current timestamp definition, the finest resolution would be 232,8 picoseconds (when I've done a correct calculation) until the lower 32 bit part of the timestamp will wrap around. Will this be enough even for 10GBit Ethernet?

__________________________________________________________________________
Erweitern Sie FreeMail zu einem noch leistungsstärkeren E-Mail-Postfach!		
Mehr Infos unter http://freemail.web.de/home/landingpad/?mc=021131