On Aug 18, 2011, at 2:04 PM, Fabrizio Giordano wrote:
> Disabling net_timestamp() in net/core/dev.c was one of the first things I
> tried, among with disabling other "get_timestamp"-like functions. But
> apparently that's not where packes get timestamped.
It is, but it's not the *only* place where they get timestamped.
> Nuno's suggestion turned out to be what I was looking for. Packets are
> actually timestamped in the function tpacket_rcv in net/packet/af_packet.c
No, the place where packets get timestamped *if they don't already have a time
stamp* is there.
The code, at least in my 2.6.32.4 source, is:
if (skb->tstamp.tv64)
tv = ktime_to_timeval(skb->tstamp);
else
do_gettimeofday(&tv);
h.h1->tp_sec = tv.tv_sec;
h.h1->tp_usec = tv.tv_usec;
and
if (skb->tstamp.tv64)
ts = ktime_to_timespec(skb->tstamp);
else
getnstimeofday(&ts);
h.h2->tp_sec = ts.tv_sec;
h.h2->tp_nsec = ts.tv_nsec;
If the packet has already been given a time stamp, skb->tstamp.tv64 will be
non-zero, and it'll call ktime_to_timeval(skb->tstamp) to convert that time
stamp to a "struct timeval" or call ktime_to_timespec() to convert it to a
"struct timespec" and use that for the time stamp.
If your goal is to avoid all time stamping of packets, it's *necessary* to
eliminate that code, but it's not *sufficient* to eliminate that code. If
you're just trying to throw away the time stamp information that lower-level
code has already added to the packet, it's sufficient to eliminate that code,
but I don't see what the *point* of doing so is - it's not as if it's going to
keep the system from spending time to read the system clock for every packet.
What is it you're trying to do here?-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
