In some email I received from Guy Harris, sie wrote: > > On Dec 9, 2004, at 2:08 PM, Darren Reed wrote: > > > In some email I received from Guy Harris, sie wrote: > >> BTW, where are you getting the nanosecond-resolution time stamps in > >> Solaris? > > > > gethrtime > > That says what the high-resolution time counter's value is now, not > what the value was when bufmod saw the packet (which raises another > issue, namely that the time stamps you get out of libpcap might have > nanosecond *precision* but they might not have nanosecond *accuracy*) - > or are the packets in question not being captured by libpcap, so that > you can use "gethrtime()" to time stamp packets reasonably close to the > time t which they arrived?
I think that whether it is bufmod or a program that generates a time stamp, it is still a software timestamp and sometime after the actual packet "arrived". So what am I trying to say here? Unless you have hardware timestamps in captured packets, one software timestamp is as good as the next in a well written application. Darren - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
