Re: [tcpdump-workers] Hardware timestamp ?

2009-02-27 Thread Guy Harris
On Feb 26, 2009, at 5:22 PM, Guy Harris wrote: The *accuracy* is limited by the fact that most network adapters aren't designed primarily for use when capturing traffic, so they don't do their own packet timestamping, and libpcap normally just plugs into the OS's built-in facilities for

[tcpdump-workers] Cenereal questions

2009-02-27 Thread Alexey Boutenko
Hello. I'm new to libpcap and tcpdump. And i have several questions.1) I'm doing same term project about network api in linux/unix-like systems. And i need some scheme of how libpcap organized, without any details, just some basic principles. Where can i find information like this, or

[tcpdump-workers] Filter incoming or leaving packets

2009-02-27 Thread Johan Mazel
Hello I would like to know if there is a way to use pcap_compile() to filter only incoming packets or only leaving packets in a host/network interface ? I search in the snort doc and in this tutorial ( http://yuba.stanford.edu/~casado/pcap/section3.html), I found stuff linked to the filtering of

Re: [tcpdump-workers] Hardware timestamp ?

2009-02-27 Thread David Young
On Thu, Feb 26, 2009 at 06:49:45PM -0600, Pierre Karampournis wrote: Hi, I am currently working in a university lab and I need to capture packets with a nanosecond precision timestamp using the Pcap format. Pierre, If you tell us what you are trying to accomplish with nanosecond

Re: [tcpdump-workers] Filter incoming or leaving packets

2009-02-27 Thread Aaron Turner
On Fri, Feb 27, 2009 at 6:53 AM, Johan Mazel johan.ma...@gmail.com wrote: Hello I would like to know if there is a way to use pcap_compile() to filter only incoming packets or only leaving packets in a host/network interface ? I search in the snort doc and in this tutorial (

Re: [tcpdump-workers] Hardware timestamp ?

2009-02-27 Thread Pierre KARAMPOURNIS
2009/2/27 David Young dyo...@pobox.com On Thu, Feb 26, 2009 at 06:49:45PM -0600, Pierre Karampournis wrote: Hi, I am currently working in a university lab and I need to capture packets with a nanosecond precision timestamp using the Pcap format. Pierre, If you tell us what you are

Re: [tcpdump-workers] Hardware timestamp ?

2009-02-27 Thread Pierre KARAMPOURNIS
2009/2/27 Pierre KARAMPOURNIS pkarampour...@gmail.com 2009/2/27 David Young dyo...@pobox.com On Thu, Feb 26, 2009 at 06:49:45PM -0600, Pierre Karampournis wrote: Hi, I am currently working in a university lab and I need to capture packets with a nanosecond precision timestamp using

Re: [tcpdump-workers] Hardware timestamp ?

2009-02-27 Thread Guy Harris
On Feb 27, 2009, at 9:03 AM, Pierre KARAMPOURNIS wrote: I worked on old Linux Kernel versions so I will try the latest ones to see hardware timestamping. So now I have to search for Network cards which can timestamp the packets with nanosecond resolution (Endace DAG cards can apparently do