RadioTap Archive on
 help / color / Atom feed
From: Johannes Berg <>
To: Guy Harris <guy-FrUbXkNCsVf2fBVCVOL8/>
Cc: David Young <>,,
	Simon Barber <>
Subject: Re: [RFC] capture file timestamping
Date: Tue, 25 Aug 2015 19:55:46 +0200
Message-ID: <> (raw)
In-Reply-To: <4E4FE63E-B636-4808-BBFF-6D2CE4EAFB2F-FrUbXkNCsVf2fBVCVOL8/>

On Tue, 2015-08-25 at 10:47 -0700, Guy Harris wrote:
> If you have tcpdump 4.6 or later, with libpcap 1.6 or later, on 
> Linux, you should have the --time-stamp-type and --list-time-stamp
> -types options.
> If so, what does
> 	> tcpdump --list-time-stamp-types
> print?
> If it prints "adapter" or "adapter_unsynced", you might want to try 
> those with the --time-stamp-type option, as those time stamp types 
> mean that the time stamp will come from the adapter rather than from 
> Linux.  ("unsynced" means that the time stamps aren't synchronized 
> with the host's clock.)

It does have "adapter_unsynced", but wouldn't the adapter also have to
support it? Ah, yes, if I do
	tcpdump -i wlan0 --list-time-stamp-types

it no longer shows it.

Although perhaps I could possibly convince the driver to report this
timestamp somehow, rather than changing radiotap.

> unless it's based on the TSF (which it probably won't be, as it 
> should, at least in principle, be Epoch time, although I think Linux 
> may have, at some point, changed adapter time stamps in a fashion 
> making them not useful as libpcap time stamps).

That, however, I almost certainly cannot do - I don't see how I'd
synchronize from the adapter time (a free-running 32-bit counter at
microseconds resolution) to the host time.


  parent reply index

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-08-25 10:07 Johannes Berg
     [not found] ` <>
2015-08-25 16:28   ` David Young
     [not found]     ` <>
2015-08-25 16:46       ` Johannes Berg
     [not found]         ` <>
2015-08-25 17:47           ` Guy Harris
     [not found]             ` <4E4FE63E-B636-4808-BBFF-6D2CE4EAFB2F-FrUbXkNCsVf2fBVCVOL8/>
2015-08-25 17:55               ` Johannes Berg [this message]
2015-08-26 22:48           ` Simon Barber
     [not found]             ` <>
2015-09-17 16:51               ` Johannes Berg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \
    --cc=guy-FrUbXkNCsVf2fBVCVOL8/ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

RadioTap Archive on

Archives are clonable:
	git clone --mirror radiotap/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 radiotap radiotap/ \
	public-inbox-index radiotap

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone