RadioTap Archive on
 help / color / Atom feed
From: Guy Harris <guy-FrUbXkNCsVf2fBVCVOL8/>
To: Johannes Berg <>
Cc: David Young <>,,
	Simon Barber <>
Subject: Re: [RFC] capture file timestamping
Date: Tue, 25 Aug 2015 10:47:48 -0700
Message-ID: <> (raw)
In-Reply-To: <>

On Aug 25, 2015, at 9:46 AM, Johannes Berg <> wrote:

> The timestamps added by the capture (e.g. tcpdump) are also notoriously
> unreliable since there are processing delays - even without reordering.

If you have tcpdump 4.6 or later, with libpcap 1.6 or later, on Linux, you should have the --time-stamp-type and --list-time-stamp-types options.

If so, what does

	tcpdump --list-time-stamp-types


If it prints "adapter" or "adapter_unsynced", you might want to try those with the --time-stamp-type option, as those time stamp types mean that the time stamp will come from the adapter rather than from Linux.  ("unsynced" means that the time stamps aren't synchronized with the host's clock.)

That won't address

> b) the timestamps there are at the end of the frame,
>    beginning is much more useful

unless that's how the adapter time-stamps the packet and won't address

> c) the timer I'm getting is an internal hardware timer and I can't
>    easily derive either a TSF-based value, nor easily put it at the
>    first bit/symbol of the MPDU (since it's earlier) [*]

unless it's based on the TSF (which it probably won't be, as it should, at least in principle, be Epoch time, although I think Linux may have, at some point, changed adapter time stamps in a fashion making them not useful as libpcap time stamps).

(I.e., the "host time stamps are applied at times not well correlated with actual network events" problem is not best solved with radiotap, it's best solved by libpcap and the capture mechanism atop which it runs, but "I want a time stamp that comes from the TSF timers" is one best solved with radiotap.)

  parent reply index

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-08-25 10:07 Johannes Berg
     [not found] ` <>
2015-08-25 16:28   ` David Young
     [not found]     ` <>
2015-08-25 16:46       ` Johannes Berg
     [not found]         ` <>
2015-08-25 17:47           ` Guy Harris [this message]
     [not found]             ` <4E4FE63E-B636-4808-BBFF-6D2CE4EAFB2F-FrUbXkNCsVf2fBVCVOL8/>
2015-08-25 17:55               ` Johannes Berg
2015-08-26 22:48           ` Simon Barber
     [not found]             ` <>
2015-09-17 16:51               ` Johannes Berg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \
    --to=guy-frubxkncsvf2fbvcvol8/ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

RadioTap Archive on

Archives are clonable:
	git clone --mirror radiotap/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 radiotap radiotap/ \
	public-inbox-index radiotap

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone