Problems with ns Timestamps

[Christian <christian.rupp.stuttgart () freenet de>]

Hello Guys.

I have encountered a problem.

I am capturing Packages with hardware timestamps and nanosecond 
precision...but the timestamps are bugged.

sadly I'm not at the place where I captured the data, so the used used 
command might be slightly different, as I have to work from my memory:
tcpdump -i eth4 port 33330 -v -tt -j adapter_unsynced 
--time-stamp-precision=nano > dumpfile

The problem is, that if the time is at below 100ms, the 0.1  field is 
not 0 as it should be, but doesn't exist.

Here are two instances, where this happened.

1469090574.96991243 IP (tos 0x4, ttl 64, id 761, offset 0, flags [DF], 
proto UDP (17), length 1026)
    10.124.10.11.58050 > 10.124.10.12.33330: UDP, length 998
1469090574.135096345 IP (tos 0x4, ttl 64, id 770, offset 0, flags [DF], 
proto UDP (17), length 1488)
    10.124.10.11.58050 > 10.124.10.12.33330: UDP, length 1460

1469090573.977625339 IP (tos 0x4, ttl 64, id 47, offset 0, flags [DF], 
proto UDP (17), length 1488)
    10.124.10.11.58050 > 10.124.10.12.33330: UDP, length 1460
1469090573.977637547 IP (tos 0x4, ttl 64, id 48, offset 0, flags [DF], 
proto UDP (17), length 1449)
    10.124.10.11.58050 > 10.124.10.12.33330: UDP, length 1421
1469090574.15410642 IP (tos 0x4, ttl 64, id 49, offset 0, flags [DF], 
proto UDP (17), length 1488)
    10.124.10.11.58050 > 10.124.10.12.33330: UDP, length 1460
1469090574.15422849 IP (tos 0x4, ttl 64, id 50, offset 0, flags [DF], 
proto UDP (17), length 1488)
    10.124.10.11.58050 > 10.124.10.12.33330: UDP, length 1460


Here are some examples, that I would have used for my project(because of 
that the . is gone. first field is the id, the scond one is the 
Timestamp converted to ns), so you can see, that the field is only 
missing , if the field would look like this x.0x


59916   1469090572979755780
59917   1469090572979767988
59923   146909057314918024
59924   146909057314930232

60603   146909057399982292
60604   146909057399994500
60605   1469090573100006708
60606   1469090573100018916

47      1469090573977625339
48      1469090573977637547
49      146909057415410642
50      146909057415422849

760     146909057496979035
761     146909057496991243
770     1469090574135096345
771     1469090574135118217


Thank you in advance for any help in the matter.


Greeting,
Christian
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers