In some email I received from Guy Harris, sie wrote: > On Sep 8, 2004, at 2:26 AM, Bruce M Simpson wrote: > > > Here's a patch against 5.3 to add a per-instance switch which allows > > the user to specify if captured packets should be timestamped (and, > > if so, whether microtime() or the faster but less accurate > > getmicrotime() call should be used). > > This is probably a pointless optimization, as you probably relatively > rarely have multiple BPF devices bound to the same interface receiving > the bulk of the packets (as opposed to some daemon with a filter that > passes only the packets it's interested in), but would there be any > advantage to having "bpf_tap()" and "bpf_mtap()" fetch the time stamp > and pass that to "catchpacket()", so that in the case where there *is* > more than one tap, the time stamp is only fetched once?
That makes sense and allows you to correllate packet time stamps from a daemon collecting packets with those you see in tcpdump output when you run that in parallel to make sure things are moving. Darren - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
