The return value of QuerySystemTime and QueryPerformanceCounter is synchronized at the beginning of the capture (to compute the offset between epoch time and QueryPerformanceCounter), and then the counter and frequency returned by QPC are used to compute the number of seconds (and microseconds) and added to the offset.
The timestamping code is available in the source code of WinPcap, winpcap\packetntx\driver\time_calls.h Have a nice day GV -------------------------------------------------- From: "Jan Martinec" <[email protected]> Sent: Tuesday, September 14, 2010 7:23 AM To: <[email protected]> Subject: [Winpcap-users] timestamp > Hello! > I've got a question about timestamping method. I know that a timestamp > is got using method QueryPerformanceCounter (resp. > keQueryPerformanceCounter), which is a number of ticks of Performance > counter. But timestamp is by Winpcap returned in "Seconds since Epoch" > format. So how is the recomputation done? > > Thank you very much > > Best regards, > Jan Martinec > > > _______________________________________________ > Winpcap-users mailing list > [email protected] > https://www.winpcap.org/mailman/listinfo/winpcap-users _______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
