[Winpcap-users] Where does the Winpcap timestamp comefrom?andothers

[Gianluca Varenni]

  ----- Original Message ----- 
  From: John Wang 
  To: winpcap-users at winpcap.org 
  Cc: tien-fu.lu at adelaide.edu.au 
  Sent: Tuesday, May 05, 2009 12:19 AM
  Subject: Re: [Winpcap-users] Where does the Winpcap timestamp comefrom?andothers


  Hi,


  2009/5/5 Gianluca Varenni <gianluca.varenni at cacetech.com>


      ----- Original Message ----- 
      From: John Wang 
      To: winpcap-users at winpcap.org 
      Sent: Saturday, May 02, 2009 8:45 PM
      Subject: Re: [Winpcap-users] Where does the Winpcap timestamp come from?andothers


      Hi ,



        >>2. Which function in the NPF or Packet.dll can be used as a trigger to request CPU timer, like queryperformancecounter (), to >>timestamp the arrival packet to obatin higher precision?

        >>--GV--
        >>There is no way to obtain higher precision than we are currently using in WinPcap, apart from using custom hardware that >>timestamps the packets in the hardware itself.
        >>--GV--

      Is there any possible to know that which function inside WinPcap is used to timestamp the packets?

    The functions used to timestamp packets are in the driver code, in the file time_calls.h. Packets are timestamped in function "NPF_Tap", look for "GET_TIME"




        >>4. Can I reduce the size of the user buffer inside the NPF to set it small enough to triger the CPU timer to timestamp when >>every packet is arrival?

        >>-GV--
        >>Timestamps are generated before the packet is stored in the buffers. So changing the buffer size doesn't help.
        >>--GV--

      Because I try to timestamp the arrival packets again by using my timing functions, I'm looking for a trigger. As I know, the frequency of NPF copying the arrival packets from kernel space to user space depends on the size of user buffer. If I can set the size of user buffer as same as the size of one arrival packet, then, the NPF would copy every single packet from kernel space to user space
      once the packet arrives. And I can use this operation as a trigger to timestamp the arrival packet again with my timing functions, am I right?

    You don't want to do that. Unless you want to kill your application performance. What exactly are you trying to achieve with your timing functions vs. the timestamps generated by WinPcap?


  I'm trying to record the packets arrival timestamp in nanosecond precision. Then I will compare the arrival timestamp with a microsecond precision transmitting timesamp from the transmitter to explore the performance of wireless network. If my method can't work, do you have any suggestion how can I get the nanosecond packets arrival timestamp from the wireless adapter or Winpcap?




There is no way you can get nanosecond precision timestamps in software. Windows, like Linux, is not a real-time OS, so it doesn't give you any guarantee of when an operation will end, and this includes timestamping packets.

 The only way to obtain that is to have some device that timestamps packets in hardware. And even in that case, most of the times the timestamps have microsecond precision (this is what we have with the AirPcap adapters in hardware).

GV


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090505/2b25ff64/attachment.htm