[Evan Huus <eapache@xxxxxxxxx>]

http://www.tcpdump.org/faq.html#q8

http://www.tcpdump.org/faq.html#q9

In short, it depends on your hardware and your kernel.

Also note that pcap files only support microsecond-resolution timestamps. Pcapng files support nanosecond-resolution timestamps.

Evan

On 2013-09-05, at 5:46 AM, Joerg Mayer <jmayer@xxxxxxxxx> wrote:

Hello,

I am capturing with dumpcap or tcpdump on a Linux machine.
Can someone provide me with some information/link(s) on
a) how precise the timestamps on an average Linux PC are
b) whether there are ways to improve the precision (OS wise or code wise)
c) a way of determining the timestamp precision of a given machine
d) what I should really have asked ;-)
What I'm interested in is not so much the absolute timestamp but the
precision of the delta between packets captured on the same interface.

Thanks
   Jörg
--
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe