I investigated the packet timestamps shown with the version
of tcpdump associated with RedHat 4.2, since they come out with
jiffy resolution, and I am used to microsecond resolution.
Here is a conversation I had with Craig Lerse, speaking for
libpcap@ee.lbl.gov:
Larry:
: Craig:
: > Larry:
: > >
: > > [timestamp resolution in Linux-2.0.30/tcpdump-3.3/libpcap-0.3]
: > >
: > > Option 1: Change pcap-linux.c to grab a time stamp with
: > > gettimeofday() every time it comes out of recvfrom().
: > >
: > > Option 2: Change linux/net/core/dev.c (two places) from
: > > skb->stamp = xtime;
: > > to
: > > do_gettimeofday(&(skb->stamp));
: >
: > I think the best approach would be to submit your 2nd option
: > to the linux folks. If we change it to use gettimeofday(),
: > then the timestamp would have more resolution but less
: > accuracy since it might not be taken until after terminal i/o.
:
: I stuffed the gettimeofday() call right after the
: } while (strcmp(p->md.device, from.sa_data));
: loop, which should avoid any I/O between the recvfrom() and
: the gettimeofday(). There is no denying that accuracy suffers
: from measuring time in user space.
:
: > Upgrading the kernel to provide better timestamps is a better
: > solution for the long run.
:
: Except that on PC hardware, do_gettimofday() takes a few microseconds
: to run, because the stoopid clock chip is on the slow ISA bus.
: This overhead would be added to the interrupt processing on every
: packet transmitted or received, whether someone cared or not.
: At least, this "upgrade" would have to be compile-time configurable,
: and possibly better would be a run-time switch (which seems to be
: all the rage in the development tree).
I made (trivial) patches for the two possible "fixes":
http://recycle.jlab.org/~ldoolitt/stuff/patch-dev.diff
http://recycle.jlab.org/~ldoolitt/stuff/patch-pcap.diff
I am using patch-pcap.diff, it works fine. I checked that patch-dev
compiles and links, but I haven't rebooted so I can't verify its
functionality.
Putting an accurate timestamp on the packet might be good for
xntp, as well, if it were configured/modified to take advantage
of it. Any comments?
- Larry Doolittle ldoolitt@jlab.org
P.S., I only check the mailing list a few times a week. If you
want to discuss this with me, direct e-mail might work better than
this list.