[Winpcap-users] timestamp

[Gianluca Varenni]

The return value of QuerySystemTime and QueryPerformanceCounter is 
synchronized at the beginning of the capture (to compute the offset between 
epoch time and QueryPerformanceCounter), and then the counter and frequency 
returned by QPC are used to compute the number of seconds (and microseconds) 
and added to the offset.

The timestamping code is available in the source code of WinPcap, 
winpcap\packetntx\driver\time_calls.h

Have a nice day
GV



--------------------------------------------------
From: "Jan Martinec" <martij12 at fel.cvut.cz>
Sent: Tuesday, September 14, 2010 7:23 AM
To: <winpcap-users at winpcap.org>
Subject: [Winpcap-users] timestamp

> Hello!
> I've got a question about timestamping method. I know that a timestamp
> is got using method QueryPerformanceCounter (resp.
> keQueryPerformanceCounter), which is a number of ticks of Performance
> counter. But timestamp is by Winpcap returned in "Seconds since Epoch"
> format. So how is the recomputation done?
>
> Thank you very much
>
> Best regards,
> Jan Martinec
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users