[Winpcap-users] Packet Capture Timestamp

[Guy Harris]

On Jun 23, 2005, at 12:18 PM, Ben Greear wrote:

> I guess it depends on how smart the IDS is.  Why do you ask?

If what he really means is "it can take a significant amount of time  
to generate a time stamp, and my application doesn't need it, so is  
there a way for my application to turn that off?", the answer is, I  
think, currently "no", although an API to request that might then be  
useful.

(Presumably he now knows, if he didn't know already, that the answer  
to "is there any reason at all to time stamp packets?" is a definite  
"yes" - if you're capturing traffic in order to see why something's  
slow, you'd need the time stamps to see what requests are being sent  
over the wire and how long it's taking for {responses, TCP ACKs, etc.}.)