Hi, ----- Original Message ----- From: "Gisle Vanem" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, January 08, 2003 1:42 PM Subject: Re: [WinPcap-users] Drifting reference time in WinPcap NPF driver.
> "Loris Degioanni" <[EMAIL PROTECTED]> said: > > > Yes, but note that (as far as I know) this is the only way documented by > > Microsoft to obtain microsecond precise timestamps in a Windows NTx kernel. > > Actually, the driver can provide a different method, based on the RDTSC > > instruction that is present on most processors. To enable it, you have to > > compile the driver with the > > > > compile2k RDTSC > > > > command line. However, I suspect that this method will not completely solve > > the drift problem, since in this case the processor frequency is calculated > > manually when the driver starts, which is not very precise. > > Could the values in > HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 > > be used instead? It includes a "~MHz" value, but don't know how precise it is. The problems are: - the processor frequency is not granted to remain stable for the whole capture, especially if the capture lasts for a long time. The frequency could have small but sensible variations due to temperature changes. Moreover, technologies like Intel speedstep can change the frequency dinamycally during the capture. - most important, as you noted this value a MHz precision, that is insufficient to avoid considerable drifts Loris > Gisle V. > > # rm /bin/laden > /bin/laden: Not found > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[email protected]/ To unsubscribe use mailto: [EMAIL PROTECTED]?body=unsubscribe ==================================================================
