On Tue, Mar 12, 2002 at 10:19:05AM +0100, Julien Fries wrote:
> I have a little problem with tcpdump on linux 2.4.7. In fact, when I
> sniff the trafic, the clock printed is not as precise as it should be.
...
> What can I do to solve it ?
The time stamps tcpdump reports come from libpcap; the time stamps
libpcap supplies come from the kernel.
This is probably either the result of some kernel configuration option
not being set, or a kernel problem.
Unfortunately, I don't remember what configuration options, if any, are
needed to get the kernel to use your machine's high-resolution timer (if
it has one; if it doesn't, you won't get high-resolution time stamps).
I also don't know what kernel issues there might be. Here's some other
mail on this topic:
Date: Thu, 21 Mar 2002 14:44:52 -0600
From: Grant Edwards <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [tcpdump-workers] Timestamp resolution under Linux better than 10ms?
A few months back, I upgraded from RH6.2 (2.2.x) to RH7.2
(2.4.10). My timestamps used to have 1us resolution, now they
have 10ms resolution. This really sucks, since I'm trying to
measure thing to an accuracy of 200us or so.
I've verified that gettimeofday() called from userland has 1us
resolution.
What do I need to do to again have 1us timestamp resolutios
from libpcap?
I've tried Pentium II and AMD K6 machines. Both have better
than 1us resolution running RH6.2 or Debian 2.2, but 10ms
resolution when running RH7.2.
One would guess there's something wrong with network stack
configuration in RH7.2, but I don't know where to look.
--
Grant Edwards
[EMAIL PROTECTED]
Date: Thu, 21 Mar 2002 17:41:51 -0600
From: Grant Edwards <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [tcpdump-workers] Timestamp resolution under Linux better than 10ms?
> A few months back, I upgraded from RH6.2 (2.2.x) to RH7.2
> (2.4.10). My timestamps used to have 1us resolution, now they
> have 10ms resolution. This really sucks, since I'm trying to
> measure thing to an accuracy of 200us or so.
[...]
> One would guess there's something wrong with network stack
> configuration in RH7.2, but I don't know where to look.
Sorry for the bother. It indeed appears to be something RedHat
did to the kenel. I compiled 2.4.18 fresh from kernel.org, and
it works fine now.
--
Grant Edwards
[EMAIL PROTECTED]
Date: Thu, 21 Mar 2002 15:40:38 -0800
From: Guy Harris <[EMAIL PROTECTED]>
To: Grant Edwards <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED]
Subject: Re: [tcpdump-workers] Timestamp resolution under Linux better than 10ms?
On Thu, Mar 21, 2002 at 05:41:51PM -0600, Grant Edwards wrote:
>
> > A few months back, I upgraded from RH6.2 (2.2.x) to RH7.2
> > (2.4.10). My timestamps used to have 1us resolution, now they
> > have 10ms resolution. This really sucks, since I'm trying to
> > measure thing to an accuracy of 200us or so.
> [...]
> > One would guess there's something wrong with network stack
> > configuration in RH7.2, but I don't know where to look.
>
> Sorry for the bother. It indeed appears to be something RedHat
> did to the kenel. I compiled 2.4.18 fresh from kernel.org, and
> it works fine now.
What happens with 2.4.10 fresh from kernel.org?
If it has the same problem, perhaps it's some bug fixed between 2.4.10
and 2.4.18.
If I remember correctly, there might be, in at least some versions of
the kernel, some configuration flag you have to turn on to get time
stamps of various sorts to use high-resolution timers. Does anybody
know what they are? That would be useful to put into the tcpdump FAQ.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
