Ethereal-users: Re: [Ethereal-users] When Ethereal registering timestamp?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 17 Feb 2003 16:36:18 -0800
On Mon, Feb 17, 2003 at 08:47:48AM +0200, Dangis wrote:
> Who know, when Ethereal (or Wincap) registering arrived packet timestamp?

Ethereal doesn't add the time stamp to packets; that's done by
libpcap/WinPcap, so you should probably ask the WinPcap developers if
you're running on Windows.

However:

> May be that registering packet arrival after CRC calculation (or before)?

It is almost certainly after the CRC calculation.  The time stamp is
added to the packet by the WinPcap driver, after the packet has been
supplied to it by the network device driver.  That means that the packet
is applied after the network driver has processed the packet - which
won't happen until the network interface delivers the packet to the
driver.  As the CRC calculation is done by the network interface, and
the packet is discarded if the CRC calculation fails, the CRC
calculation is done before the interface delivers the packet to the
driver.