[Winpcap-users] Where does the Winpcap timestampcomefrom?andothers

[Gianluca Varenni]

  ----- Original Message ----- 
  From: John Wang 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, May 06, 2009 6:36 AM
  Subject: Re: [Winpcap-users] Where does the Winpcap timestampcomefrom?andothers


  Hi,

  I'm a little bit confused about where exactly the arrival packets timestamps come from, in our first email, you said:

  "1. Where does the NPF get the time information to timestamp these incoming packet? The time information comes from a on board timer in the adapter or from a CPU or similar computer clock? 

  --GV--
  From the computer clock when the packet gets delivered to WinPcap."

  I think that means the timestamps come from computer timer, like CPU timer. But in you last email, you said:

  "The only way to obtain that is to have some device that timestamps packets in hardware. And even in that case, most of the times the timestamps have microsecond precision (this is what we have with the AirPcap adapters in hardware)."

  That sounds like, the AirPcap adapter has a timer build in it, and the arrival packets timestamps come from this build in timer.

  So I want to get the confirmation from you, whether the arrival packets are timestamped by the computer timer or the AirPcap adapter build in timer.

In the case of the AirPcap adapters, which are *custom* capture devices, we provide two timestamps: software based ones and hardware based ones. The hardware based ones are generated by the chipset itself and have microsecond precision. 

If you use WinPcap on a standard network adapter (doesn't matter if it's wireless or not), you just have software timestamps.

Let me know if this makes any sense to you.

Have a nice day
GV

  Cheers

  John



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090506/16634226/attachment.htm