[Winpcap-users] Re: Where does pcap capturing time come from?

[Isara Anantavrasilp]

According to this:
http://www.mail-archive.com/winpcap-users@winpcap.polito.it/msg02514.html

I learned that pcap called KeQueryPerformanceCounter() to get clock
ticks since the system starts.
To me, that ticks is more useful than timeval.
How can I access the raw cpu time?

-- Isara

On 8/28/06, Isara Anantavrasilp <isara.a at gmail.com> wrote:
> Hi,
>
> There are two questions regarding the topic.
> 1) Winpcap gets you the capturing time in pcap_pkthdr. I would like to
> know what is the timestamp exactly?
> Is it the time when the packet pass through the network interface?
> And if so, it is in which network layer?
> As pcap can capture ethernet header, I believe this time is the time
> where outgoing packet is about to enter physical layer and incoming
> packets is about to enter from the physical layer.
>
>
> 2) I ran across this gettimeofday code:
> http://www.usenet.com/newsgroups/comp.ai.neural-nets/msg01068.html
> Is it the same algorithm as the way pcap got its timestamp?
>
> Thanks a lot!
> Isara Anantavrasilp
>