[ntar-workers] Timestamp resolution: if_tsaccur option unclear!

[Guy Harris]

Ulf Lamping wrote:

> I'm currently looking for a way to bring nanosecond timestamp
> resolution to Ethereal. Unfortunately this is urgent, so I cannot wait
> until the NTAR lib is integrated into Ethereal. To achieve this goal I'm
> planning to use a new libpcap DLT_ value and simply put nanosecond
> resolution into the microsecond timestamp field.

A new magic number would be more appropriate.  (Navtel Communications' 
magic number 0xa12b3c4d could, in theory, work, but I don't think we got 
a definitive statement from Dumas Hwang of Navtel that their format is 
exactly the same as standard libpcap format, except for the time stamps 
being in seconds/nanoseconds rather than seconds/microseconds.  There's 
probably not much of a problem with assigning *another* magic number for 
that purpose.)

> As I don't want to reinvent the wheel, I had a look at how the
> timestamp resolution is specificated in the new PCAP file format and
> simply use as much as possible of this spec.

So are you thinking of a format that also adds a time stamp resolution 
field to the file header?  (The "sigfigs" field in the current header is 
just given as the "accuracy of timestamps", but has never been used; I 
assume the intent wasn't to give the resolution of the sub-second field 
of the timestamp, but to give an indication of how much of that is 
significant.)

> IMHO I've found a bug in the format specification:
> http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html. 
> 
> The description of the if_tsaccur option of the "3.2 Interface
> Description Block (mandatory)":
> 
> To qoute: "Precision of timestamps. If the Most Significant Bit is
> equal to zero, the remaining bits indicates the accuracy as as a
> negative power of 10 (e.g. 6 means microsecond accuracy). If the Most
> Significant Bit is equal to zero, the remaining bits indicates the
> accuracy as as negative power of 2 (e.g. 10 means 1/1024 of second). If
> this option is not present, a precision of 10^-6 is assumed."
> 
> Well, both sentences starts with the identical: "If the Most
> Significant Bit is equal to zero"?!? One of the sentences should include
> one and not zero :-)
> 
> Could you tell me the correct way and update the spec accordingly?

The second one is *probably* the one that should say "is equal to one", 
but, if so, yes, the spec needs to be fixed to say so explicitly.

> BTW: The starting sentence "Precision of timestamps" is a bit
> misleading, as the if_tsaccur option will only affect the lower 32 bit
> part of the timestamp, according to the packet block format description.
> "Precision of Timestamp (Low)" might be better.

Perhaps, although the upper portion of the time stamp is always in 
seconds, and one could think of the precision field specifying the 
precision of the combination of the upper and lower portions of the tie 
stamp field.

> P.S: With the current timestamp definition, the finest resolution
> would be 232,8 picoseconds (when I've done a correct calculation) until
> the lower 32 bit part of the timestamp will wrap around. Will this be
> enough even for 10GBit Ethernet?

Note also that the upper portion will wrap around in 2038....