On Dec 9, 2004, at 3:23 PM, Darren Reed wrote:
So what am I trying to say here? Unless you have hardware timestamps in captured packets, one software timestamp is as good as the next in a well written application.
...or as bad as the next.
If you want absolute time stamps, nanosecond resolution with anything other than hardware timestamps is probably overkill - *microsecond* resolution is probably overkill.
If you want relative time stamps, the higher resolution is useful with software time stamps only to the extent that the jitter in the delay between packet arrival and time stamping is enough less than the resolution that you're not measuring noise with those extra bits of resolution (unless one goal is to measure the times when the packet made it through the networking software, but, in that case, you really *do* want the bufmod time stamp, except that it doesn't exactly reflect the time when the packet was seen by, say, the IP layer).
So, yes, one software time stamp is as good - or as bad - as the next, but in that case I suspect that the boring old microsecond time stamp from bufmod is as good as any nanosecond-precision time stamp you might synthesize.
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
