No subject


Sun Apr 26 11:05:29 PDT 2009


--GV--

2. Which function in the NPF or Packet.dll can be used as a trigger to =
request CPU timer, like queryperformancecounter (), to timestamp the =
arrival packet to obatin higher precision?

--GV--
There is no way to obtain higher precision than we are currently using =
in WinPcap, apart from using custom hardware that timestamps the packets =
in the hardware itself.
--GV--

3. Is there any performance difference if I request the triger function =
through wpcap.dll and packet.dll?

--GV--
No. Packets are timestamped in the driver, not in user  mode.
--GV--

4. Can I reduce the size of the user buffer inside the NPF to set it =
small enough to triger the CPU timer to timestamp when every packet is =
arrival?

--GV--
Timestamps are generated before the packet is stored in the buffers. So =
changing the buffer size doesn't help.
--GV--



Thanks for all your help.

Cheers

John



-------------------------------------------------------------------------=
-----


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users

------=_NextPart_000_0AAC_01C9CA39.61C5A820
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.6000.16825" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT size=3D2></FONT>&nbsp;</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV style=3D"FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV=20
  style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: =
black"><B>From:</B>=20
  <A title=3Dlocationdev at gmail.com =
href=3D"mailto:locationdev at gmail.com">John=20
  Wang</A> </DIV>
  <DIV style=3D"FONT: 10pt arial"><B>To:</B> <A =
title=3Dwinpcap-users at winpcap.org=20
  =
href=3D"mailto:winpcap-users at winpcap.org">winpcap-users at winpcap.org</A> =
</DIV>
  <DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Friday, May 01, 2009 1:09 =
AM</DIV>
  <DIV style=3D"FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Where =
does the=20
  Winpcap timestamp come from? andothers</DIV>
  <DIV><BR></DIV>
  <DIV>Hi All,<BR><BR><BR>I'm now working on a project which needs to to =
record=20
  the captured wireless packets arrival time precisely. I used Wireshark =
and=20
  CACE adapter before. But it seems they record the arrival time in=20
  microseconds. As Wireshark doesn't access the hardware directly, it =
receives=20
  the raw data from WinPcap, so I'm thinking maybe I can get more =
accurate local=20
  timestamp from winPcap directly<BR><BR>In the document of Winpcap, the =
NPF=20
  records the captured packets, and also their timestamps. I have =
several=20
  question and looking for help:<BR><BR>1. Where does the NPF get the =
time=20
  information to timestamp these incoming packet? The time information =
comes=20
  from a onboard timer in the adapter or from a CPU or similar computer=20
  clock?</DIV>
  <DIV><FONT size=3D2></FONT>&nbsp;</DIV></BLOCKQUOTE>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>From the computer clock when the packet gets =
delivered to=20
WinPcap.</FONT></DIV>
<DIV><FONT size=3D2>--GV--</FONT><BR><BR>2. Which function in the NPF or =

Packet.dll can be used as a trigger to request CPU timer, like=20
queryperformancecounter (), to timestamp the arrival packet to obatin =
higher=20
precision?</DIV>
<DIV><FONT size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>There is no way to obtain higher precision than we =
are=20
currently using in WinPcap, apart from using custom hardware that =
timestamps the=20
packets in the hardware itself.</FONT></DIV><FONT size=3D2></FONT>
<DIV><FONT size=3D2>--GV--</FONT><BR><BR>3. Is there any performance =
difference if=20
I request the triger function through wpcap.dll and packet.dll?</DIV>
<DIV><FONT size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>No. Packets are timestamped in the driver, not in =
user&nbsp;=20
mode.</FONT></DIV>
<DIV><FONT size=3D2>--GV--</FONT><BR><BR>4. Can I reduce the size of the =
user=20
buffer inside the NPF to set it small enough to triger the CPU timer to=20
timestamp when every packet is arrival?<BR></DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>Timestamps are generated before the packet is stored =
in the=20
buffers. So changing the buffer size doesn't help.</FONT></DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT size=3D2></FONT>&nbsp;</DIV>
<DIV><BR>Thanks for all your help.<BR><BR>Cheers<BR><BR>John<BR></DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <P>
  <HR>

  =
<P></P>_______________________________________________<BR>Winpcap-users=20
  mailing=20
  =
list<BR>Winpcap-users at winpcap.org<BR>https://www.winpcap.org/mailman/list=
info/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_0AAC_01C9CA39.61C5A820--



More information about the Winpcap-users mailing list