[Winpcap-users] Re: Where does pcap capturing time come from?

Isara Anantavrasilp isara.a at gmail.com
Mon Aug 28 17:08:19 GMT 2006

According to this:

I learned that pcap called KeQueryPerformanceCounter() to get clock
ticks since the system starts.
To me, that ticks is more useful than timeval.
How can I access the raw cpu time?

-- Isara

On 8/28/06, Isara Anantavrasilp <isara.a at gmail.com> wrote:
> Hi,
> There are two questions regarding the topic.
> 1) Winpcap gets you the capturing time in pcap_pkthdr. I would like to
> know what is the timestamp exactly?
> Is it the time when the packet pass through the network interface?
> And if so, it is in which network layer?
> As pcap can capture ethernet header, I believe this time is the time
> where outgoing packet is about to enter physical layer and incoming
> packets is about to enter from the physical layer.
> 2) I ran across this gettimeofday code:
> http://www.usenet.com/newsgroups/comp.ai.neural-nets/msg01068.html
> Is it the same algorithm as the way pcap got its timestamp?
> Thanks a lot!
> Isara Anantavrasilp

More information about the Winpcap-users mailing list