The timestamps have microsecond resolution, but the precision is far from being microsecond. Packets are timestamped when they reach the WinPcap protocol driver (NPF.sys), i.e. after the packets
1. have been received by the NIC card and stored into host memory 2. the NIC card has generated an interrupt to notify the NIC miniport driver that some packets are available for processing (and this can happens several microseconds after the packet has been received by the NIC and stored into host memory, interrupt coalescing) Timestamps are obtained using the function KeQueryPerformanceCounter. Have a nice day GV From: Jan Martinec Sent: Monday, July 26, 2010 10:39 AM To: [email protected] Subject: [Winpcap-users] timestamping method Hi, could I ask you which mechanism is used for the timestamping of packets in Winpcap library? Timestamps are done with precision of microsecond, but with Windows this precision is usually unreachable. So is any special timer or counter used for this purposes (for example Performance Counter or something)? I am student and I have been working on an implementation of IEEE1588 PTP protocol with using of Winpcap for packet capture. Thank you Jan Martinec -------------------------------------------------------------------------------- _______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
_______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
