From: Guy Harris <guy-FrUbXkNCsVf2fBVCVOL8/A@public.gmane.org>
To: Johannes Berg <johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
Cc: David Young <dyoung-e+AXbWqSrlAAvxtiuMwx3w@public.gmane.org>,
radiotap-S783fYmB3Ccdnm+yROfE0A@public.gmane.org,
Simon Barber <simon-vp0mx6+5gkqFX2APIN6yfw@public.gmane.org>
Subject: Re: [RFC] capture file timestamping
Date: Tue, 25 Aug 2015 10:47:48 -0700 [thread overview]
Message-ID: <4E4FE63E-B636-4808-BBFF-6D2CE4EAFB2F@alum.mit.edu> (raw)
In-Reply-To: <1440521168.2192.50.camel-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
On Aug 25, 2015, at 9:46 AM, Johannes Berg <johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org> wrote:
> The timestamps added by the capture (e.g. tcpdump) are also notoriously
> unreliable since there are processing delays - even without reordering.
If you have tcpdump 4.6 or later, with libpcap 1.6 or later, on Linux, you should have the --time-stamp-type and --list-time-stamp-types options.
If so, what does
tcpdump --list-time-stamp-types
print?
If it prints "adapter" or "adapter_unsynced", you might want to try those with the --time-stamp-type option, as those time stamp types mean that the time stamp will come from the adapter rather than from Linux. ("unsynced" means that the time stamps aren't synchronized with the host's clock.)
That won't address
> b) the timestamps there are at the end of the frame,
> beginning is much more useful
unless that's how the adapter time-stamps the packet and won't address
> c) the timer I'm getting is an internal hardware timer and I can't
> easily derive either a TSF-based value, nor easily put it at the
> first bit/symbol of the MPDU (since it's earlier) [*]
unless it's based on the TSF (which it probably won't be, as it should, at least in principle, be Epoch time, although I think Linux may have, at some point, changed adapter time stamps in a fashion making them not useful as libpcap time stamps).
(I.e., the "host time stamps are applied at times not well correlated with actual network events" problem is not best solved with radiotap, it's best solved by libpcap and the capture mechanism atop which it runs, but "I want a time stamp that comes from the TSF timers" is one best solved with radiotap.)
next prev parent reply other threads:[~2015-08-25 17:47 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-25 10:07 [RFC] capture file timestamping Johannes Berg
[not found] ` <1440497229.2192.28.camel-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
2015-08-25 16:28 ` David Young
[not found] ` <20150825162841.GR6823-e+AXbWqSrlAAvxtiuMwx3w@public.gmane.org>
2015-08-25 16:46 ` Johannes Berg
[not found] ` <1440521168.2192.50.camel-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
2015-08-25 17:47 ` Guy Harris [this message]
[not found] ` <4E4FE63E-B636-4808-BBFF-6D2CE4EAFB2F-FrUbXkNCsVf2fBVCVOL8/A@public.gmane.org>
2015-08-25 17:55 ` Johannes Berg
2015-08-26 22:48 ` Simon Barber
[not found] ` <55DE4244.9030407-vp0mx6+5gkqFX2APIN6yfw@public.gmane.org>
2015-09-17 16:51 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E4FE63E-B636-4808-BBFF-6D2CE4EAFB2F@alum.mit.edu \
--to=guy-frubxkncsvf2fbvcvol8/a@public.gmane.org \
--cc=dyoung-e+AXbWqSrlAAvxtiuMwx3w@public.gmane.org \
--cc=johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org \
--cc=radiotap-S783fYmB3Ccdnm+yROfE0A@public.gmane.org \
--cc=simon-vp0mx6+5gkqFX2APIN6yfw@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).