No subject
Sun Apr 26 11:05:29 PDT 2009
--GV--
2. Which function in the NPF or Packet.dll can be used as a trigger to =
request CPU timer, like queryperformancecounter (), to timestamp the =
arrival packet to obatin higher precision?
--GV--
There is no way to obtain higher precision than we are currently using =
in WinPcap, apart from using custom hardware that timestamps the packets =
in the hardware itself.
--GV--
3. Is there any performance difference if I request the triger function =
through wpcap.dll and packet.dll?
--GV--
No. Packets are timestamped in the driver, not in user mode.
--GV--
4. Can I reduce the size of the user buffer inside the NPF to set it =
small enough to triger the CPU timer to timestamp when every packet is =
arrival?
--GV--
Timestamps are generated before the packet is stored in the buffers. So =
changing the buffer size doesn't help.
--GV--
Thanks for all your help.
Cheers
John
-------------------------------------------------------------------------=
-----
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
------=_NextPart_000_0AAC_01C9CA39.61C5A820
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.6000.16825" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT size=3D2></FONT> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style=3D"FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV=20
style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: =
black"><B>From:</B>=20
<A title=3Dlocationdev at gmail.com =
href=3D"mailto:locationdev at gmail.com">John=20
Wang</A> </DIV>
<DIV style=3D"FONT: 10pt arial"><B>To:</B> <A =
title=3Dwinpcap-users at winpcap.org=20
=
href=3D"mailto:winpcap-users at winpcap.org">winpcap-users at winpcap.org</A> =
</DIV>
<DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Friday, May 01, 2009 1:09 =
AM</DIV>
<DIV style=3D"FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Where =
does the=20
Winpcap timestamp come from? andothers</DIV>
<DIV><BR></DIV>
<DIV>Hi All,<BR><BR><BR>I'm now working on a project which needs to to =
record=20
the captured wireless packets arrival time precisely. I used Wireshark =
and=20
CACE adapter before. But it seems they record the arrival time in=20
microseconds. As Wireshark doesn't access the hardware directly, it =
receives=20
the raw data from WinPcap, so I'm thinking maybe I can get more =
accurate local=20
timestamp from winPcap directly<BR><BR>In the document of Winpcap, the =
NPF=20
records the captured packets, and also their timestamps. I have =
several=20
question and looking for help:<BR><BR>1. Where does the NPF get the =
time=20
information to timestamp these incoming packet? The time information =
comes=20
from a onboard timer in the adapter or from a CPU or similar computer=20
clock?</DIV>
<DIV><FONT size=3D2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>From the computer clock when the packet gets =
delivered to=20
WinPcap.</FONT></DIV>
<DIV><FONT size=3D2>--GV--</FONT><BR><BR>2. Which function in the NPF or =
Packet.dll can be used as a trigger to request CPU timer, like=20
queryperformancecounter (), to timestamp the arrival packet to obatin =
higher=20
precision?</DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>There is no way to obtain higher precision than we =
are=20
currently using in WinPcap, apart from using custom hardware that =
timestamps the=20
packets in the hardware itself.</FONT></DIV><FONT size=3D2></FONT>
<DIV><FONT size=3D2>--GV--</FONT><BR><BR>3. Is there any performance =
difference if=20
I request the triger function through wpcap.dll and packet.dll?</DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>No. Packets are timestamped in the driver, not in =
user =20
mode.</FONT></DIV>
<DIV><FONT size=3D2>--GV--</FONT><BR><BR>4. Can I reduce the size of the =
user=20
buffer inside the NPF to set it small enough to triger the CPU timer to=20
timestamp when every packet is arrival?<BR></DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2>Timestamps are generated before the packet is stored =
in the=20
buffers. So changing the buffer size doesn't help.</FONT></DIV>
<DIV><FONT size=3D2>--GV--</FONT></DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><BR>Thanks for all your help.<BR><BR>Cheers<BR><BR>John<BR></DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<P>
<HR>
=
<P></P>_______________________________________________<BR>Winpcap-users=20
mailing=20
=
list<BR>Winpcap-users at winpcap.org<BR>https://www.winpcap.org/mailman/list=
info/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_0AAC_01C9CA39.61C5A820--
More information about the Winpcap-users
mailing list