Re: [RFC] capture file timestamping

On Tue, 2015-08-25 at 10:47 -0700, Guy Harris wrote:
> 
> If you have tcpdump 4.6 or later, with libpcap 1.6 or later, on 
> Linux, you should have the --time-stamp-type and --list-time-stamp
> -types options.
> 
> If so, what does
> 
> 	> tcpdump --list-time-stamp-types
> 
> print?
> 
> If it prints "adapter" or "adapter_unsynced", you might want to try 
> those with the --time-stamp-type option, as those time stamp types 
> mean that the time stamp will come from the adapter rather than from 
> Linux.  ("unsynced" means that the time stamps aren't synchronized 
> with the host's clock.)

It does have "adapter_unsynced", but wouldn't the adapter also have to
support it? Ah, yes, if I do
	tcpdump -i wlan0 --list-time-stamp-types

it no longer shows it.

Although perhaps I could possibly convince the driver to report this
timestamp somehow, rather than changing radiotap.

> unless it's based on the TSF (which it probably won't be, as it 
> should, at least in principle, be Epoch time, although I think Linux 
> may have, at some point, changed adapter time stamps in a fashion 
> making them not useful as libpcap time stamps).

That, however, I almost certainly cannot do - I don't see how I'd
synchronize from the adapter time (a free-running 32-bit counter at
microseconds resolution) to the host time.

johannes