[Winpcap-users] WinPCAP packets capture delay..

[Gianluca Varenni]

--------------------------------------------------
From: "Alimjan Kuramshin" <alimjankuramshin at gmail.com>
Sent: Wednesday, September 22, 2010 6:44 AM
To: <winpcap-users at winpcap.org>
Subject: Re: [Winpcap-users] WinPCAP packets capture delay..

>
> Hello, Gianluca! Thanks for the test and detailed answer..
>
>> Let's step back and analyze the whole issue. Correct me if any of the
>> following statements is wrong.
>>
>> - You have your custom ethernet hardware that is used to generate 
>> packets.
> Quite correct, yes..
>
>> - your hardware is able to generate packets at a constant rate, and you 
>> can
>> prove that the packets are transmitted at a constant rate with an
>> oscilloscope.
>
> Yes, i've got access to the good oscilloscope, Lecroy with an several 
> Gs/s..
>
>> - when you use a WinPcap-based app (e.g. wireshark) to capture packets,
>> every now and then you see something weird in the timestamps. Instead of
>> being all equally spaced, every now and then you see a big gap of some
>> microseconds. For example you see 40us, 40us..., 10000us, 40us...
>
> And that is wright. But also, i've notice some interesting thing: 
> sometimes timestamp of the next packet from the delay is toooo small,
> for example, i've got, us: .. 43 46 48 42 1500 2 49 41 35 48.. So, 2us 
> difference of time stamps a little bit strange i guess.
>

Can you send me a capture file taken with wireshark when you generate let's 
say 100000 packets from your hardware transmitter? Please specify what is 
the exact timestamp difference that the packets have at the transmission 
side).

Have a nice day
GV