tcpdump mailing list archives
timestamp in pcap/tcpdump
From: abhinav narain <abhinavnarain10 () gmail com>
Date: Sun, 25 Nov 2012 00:50:01 -0500
hi, I am looking for timestamp provided by pcap header and later used by tcpdump. Seems like some of wireless drivers do not provide the mac tsf timestamp. I can't figure out the timestamp meaning in pcap. Its surely not the time when packet arrived at the driver (referring to tsft). Looking at old pcap (not using mmap), it seems this is got by ioctl system, which is a deprecated mechanism ( I suppose) and not many drivers provide ioctl implementation. On the other hand, I don't have any idea how the mmap code is getting the packet timestamp ! Can someone throw light on this ? The ioctl could be traced to another function call on struct sock *, but I have not been able to comprehend the meaning of the timestamp provided. Please clarify. -Abhinav Narain _______________________________________________ tcpdump-workers mailing list tcpdump-workers () lists tcpdump org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
Current thread:
- timestamp in pcap/tcpdump abhinav narain (Nov 24)
- Re: timestamp in pcap/tcpdump Guy Harris (Nov 25)
- <Possible follow-ups>
- Re: timestamp in pcap/tcpdump Cheng Cheng (Nov 26)
- Re: timestamp in pcap/tcpdump Guy Harris (Nov 27)