<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=text/html;charset=iso-8859-2 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16588"></HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody leftMargin=0 topMargin=0 bgColor=#ffffff text=#000000
CanvasTabStop="true" name="Compose message area">
<DIV><FONT face=Calibri>The timestamps have microsecond resolution, but the
precision is far from being microsecond. Packets are timestamped when they reach
the WinPcap protocol driver (NPF.sys), i.e. after the packets</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>1. have been received by the NIC card and stored into
host memory</FONT></DIV>
<DIV><FONT face=Calibri>2. the NIC card has generated an interrupt to notify the
NIC miniport driver that some packets are available for processing (and this can
happens several microseconds after the packet has been received by the NIC and
stored into host memory, interrupt coalescing)</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>Timestamps are obtained using the function
KeQueryPerformanceCounter.</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>Have a nice day</FONT></DIV>
<DIV><FONT face=Calibri>GV</FONT></DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=martij12@fel.cvut.cz
href="mailto:martij12@fel.cvut.cz">Jan Martinec</A> </DIV>
<DIV><B>Sent:</B> Monday, July 26, 2010 10:39 AM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Subject:</B> [Winpcap-users] timestamping method</DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV style="FONT-FAMILY: -moz-fixed; FONT-SIZE: 13px" lang=x-central-euro
class=moz-text-flowed> Hi, <BR>could I ask you which mechanism is used for
the timestamping of packets in Winpcap library? <BR>Timestamps are done with
precision of microsecond, but with Windows this precision is usually
unreachable. <BR>So is any special timer or counter used for this purposes (for
example Performance Counter or something)? <BR><BR>I am student and I have been
working on an implementation of IEEE1588 PTP protocol with using of Winpcap for
packet capture. <BR><BR>Thank you <BR>Jan Martinec <BR></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BODY></HTML>