tcpdump mailing list archives

Re: Hardware timestamp ?


From: Pierre Karampournis <pkarampournis () gmail com>
Date: Mon, 02 Mar 2009 12:24:38 -0600

Guy Harris wrote :

On Feb 27, 2009, at 9:03 AM, Pierre KARAMPOURNIS wrote:

I worked on old Linux Kernel versions so I will try the latest ones to see hardware timestamping. So now I have to search for Network cards which can
timestamp the packets with nanosecond resolution (Endace DAG cards can
apparently do that)

Yes, but they're not regular networking cards, so they won't use that kernel code path on Linux; they supply packets through their own API, and that API does provide nanosecond timestamps, which libpcap turns into microsecond timestamps.

If you want a network card that supplies its own timestamps *and* functions as a regular network adapter rather than a capture-only adapter, it would need to have a Linux driver that time-stamped the skbuff containing the packet. I don't know whether any cards of that sort exist, or whether they have Linux drivers that do that (if they have open-source Linux drivers that don't, you could perhaps modify them to do so).

If, as you said, you're planning to capture traffic on a gigabit-or-faster network, you might *want* a capture-only NIC for that purpose, in which case the Endace cards would be sufficient.
I only need to capture data so endace cards should do the job. I will also modify libpcap to keep the original timestamps with nanosecond resolution so I consider the problem "solved". I didn't know the Endace devices, I was not searching in that direction, thank you for your help.

Pierre
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: