[Winpcap-users] Where does pcap capturing time come from?

[Isara Anantavrasilp]

Hi,

There are two questions regarding the topic.
1) Winpcap gets you the capturing time in pcap_pkthdr. I would like to
know what is the timestamp exactly?
Is it the time when the packet pass through the network interface?
And if so, it is in which network layer?
As pcap can capture ethernet header, I believe this time is the time
where outgoing packet is about to enter physical layer and incoming
packets is about to enter from the physical layer.


2) I ran across this gettimeofday code:
http://www.usenet.com/newsgroups/comp.ai.neural-nets/msg01068.html
Is it the same algorithm as the way pcap got its timestamp?

Thanks a lot!
Isara Anantavrasilp