Hi, i'm Andrea Cozza. I'm using WinPCap for network performance evaluating. I did a simple sniffer following Manuals indication. But i'm looking for some information on timestamp.
I didn't find it on Manual of WinPCap (if i mistaked could you show me the point where it is indicated?) I looked in Mailing list archive and i found this " Here is how the driver creates the timestamp for the accepted packets: 1. When a driver instance is opened by an application, it calculates an absolute start time value for the system (boot time) which is the number of ticks since 1/1/1970. 2. It calls KeQueryPerformanceCounter() to get the tick frequency for the system (number of ticks per second). 3. When a packet is accepted by the driver, it gets the current tick count (ticks since boot) and adds this to the start time value. This give us the number of ticks since 1/1/1970. This value is divided by the tick frequency to get the number of seconds and microseconds to use in the packet header for the timestamp values. " and some other information on KeQueryPerformanceCounter precision. But i've found some difference in the timestamp depending if sniffer run on the machine that send the packet or in another machine. I think that if the sniffer is on the computer that send packet then the timestamp is put before the packet is sent. Otherwise the timestamp is put after the packet is accepted and completely received. I've tried to understand the code but it's not so simple for me. So: - Could you exactly explain me which is the procedure followed by WinPCap to put timestamp? - Could you show me the motivation that lead to this difference? Are there differences in two cases descripted before? - Do you know if there are errors in timestamp value and which is the uncertainty associated? - Is there any kind of delay between the moment when the packet is sent or receveid and the moment when the timestamp is put? Thank you. __________________________________________________________________ Tiscali ADSL e' SENZA CANONE, paghi solo quello che consumi! Abbonati subito, Gratis per te un anno di Supermail e tanti servizi in piu'! http://point.tiscali.it/adsl/index.shtml ================================================================= This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] =================================================================
