[Winpcap-users] timestamping method

[Gianluca Varenni]

The timestamps have microsecond resolution, but the precision is far from being microsecond. Packets are timestamped when they reach the WinPcap protocol driver (NPF.sys), i.e. after the packets

1. have been received by the NIC card and stored into host memory
2. the NIC card has generated an interrupt to notify the NIC miniport driver that some packets are available for processing (and this can happens several microseconds after the packet has been received by the NIC and stored into host memory, interrupt coalescing)

Timestamps are obtained using the function KeQueryPerformanceCounter.

Have a nice day
GV


From: Jan Martinec 
Sent: Monday, July 26, 2010 10:39 AM
To: winpcap-users at winpcap.org 
Subject: [Winpcap-users] timestamping method


 Hi, 
could I ask you which mechanism is used for the timestamping of packets in Winpcap library? 
Timestamps are done with precision of microsecond, but with Windows this precision is usually unreachable. 
So is any special timer or counter used for this purposes (for example Performance Counter or something)? 

I am student and I have been working on an implementation of IEEE1588 PTP protocol with using of Winpcap for packet capture. 

Thank you 
Jan Martinec 



--------------------------------------------------------------------------------


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100726/c48fdca5/attachment.htm