Ethereal does not timestamp packets. Ethereal use whatever timestamp
the underlying OS or supportlibrary (pcap) provides to ethereal.
Whatever timestamp pcap uses and passes on depends on what
implementation is used and whatever the OS kernel tells pcap.
Even is the OS would report perfect timestamps with ns accuracy for
whenever the packet wa shandded to the network driver or the os, this
would stillb e insufficient for completely accurate timestamps since
most nics (and all? Gb nics) will postpone raising an interrupt until
either a certain ms timeout has occured or
when a certain aount/treshold of received packet has been buffered up
in the actual receive buffer on the real nic.
very few nics afaik will timestamp any packets. but some do exist.
they only work however when certain special type drivers are used
and for special api's to talk to the nic.
to get sub-ms accuracy for each individual packet, the only option is
to disable all buffering on the nic and to bypass the entire os
completely.
few applications require that accuracy to substantiate the effort to
implement these kind of special measures.
To guarantee this you are best of using a dedicated hw capture
device for capturing packets.
----- Original Message -----
From: Williams, Chris
Date: Thu, 19 Aug 2004 17:50:16 -0500
Subject: [Ethereal-users] When does Ethereal timestamp packets?
To: ethereal-users@xxxxxxxxxxxx
I'm not exactly sure how to phrase this question since I'm new to
networking issues, but I hope you can see where I'm going. I'm trying
to verify the performance of a real-time communications program and I
would like to know when packets are transmitted and received, within
the order of milliseconds. We've seen results from Ethereal that show
unexpected, discrete patterns of packets. In trying to explain this
phenomenon, I was wondering if the Ethereal timestamp represents the
instant the packet is received or some later time, can the CPU loading
or the changing of global threads effects these timestamps? When
receiving a constant stream of packets does the network driver buffer
up packets until they can be serviced which would affect the
timestamp, or is there some other networking issue that I haven't
though of?
I would appreciate any expertise that can be offered.
Best Regards,
Chris Williams
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users
