[Winpcap-users] Where does pcap capturing time come from?

Isara Anantavrasilp isara.a at gmail.com
Mon Aug 28 17:00:05 GMT 2006


There are two questions regarding the topic.
1) Winpcap gets you the capturing time in pcap_pkthdr. I would like to
know what is the timestamp exactly?
Is it the time when the packet pass through the network interface?
And if so, it is in which network layer?
As pcap can capture ethernet header, I believe this time is the time
where outgoing packet is about to enter physical layer and incoming
packets is about to enter from the physical layer.

2) I ran across this gettimeofday code:
Is it the same algorithm as the way pcap got its timestamp?

Thanks a lot!
Isara Anantavrasilp

More information about the Winpcap-users mailing list