Re: [PATCH] Add ioctl to disable bpf timestamping

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Guy Harris, sie wrote:
> On Sep 8, 2004, at 2:26 AM, Bruce M Simpson wrote:
>
> > Here's a patch against 5.3 to add a per-instance switch which allows
> > the user to specify if captured packets should be timestamped (and,
> > if so, whether microtime() or the faster but less accurate
> > getmicrotime() call should be used).
>
> This is probably a pointless optimization, as you probably relatively 
> rarely have multiple BPF devices bound to the same interface receiving 
> the bulk of the packets (as opposed to some daemon with a filter that 
> passes only the packets it's interested in), but would there be any 
> advantage to having "bpf_tap()" and "bpf_mtap()" fetch the time stamp 
> and pass that to "catchpacket()", so that in the case where there *is* 
> more than one tap, the time stamp is only fetched once?

That makes sense and allows you to correllate packet time stamps from
a daemon collecting packets with those you see in tcpdump output when
you run that in parallel to make sure things are moving.

Darren
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.