Obtain hardware timestamp

Question

Is the time obtained by the pcap_next_ex function in libpcap the hard timestamp of the network card? If not, how to obtain the hard timestamp when the packet is received pcap_next_ex(pcap_t* p,struct pcap_pkthdr** pkt_header,const u_char** pkt_data)

Answer 1

Is the time obtained by the pcap_next_ex function in libpcap the hard timestamp of the network card?

Only if the code path that delivers packets to libpcap gets a timestamp from the network card and provides it.

Currently, the only operating system on which libpcap provides an option to get hardware timestamps on regular network interfaces is Linux, but that's not the default; by default, packets get the standard Linux networking stack time stamp, which is generated by the OS when the packet is processed.

Some specialized devices, where libpcap doesn't use the regular networking stack to get packets, might provide hardware time stamps. That might be the case for Endace DAG cards, but I don't know whether that's the case.

If not, how to obtain the hard timestamp when the packet is received

You will need to use the new pcap_create()/pcap_activate() API, rather than the old pcap_open_live() API, to open the adapter.

After calling pcap_create(), call pcap_list_tstamp_types(); it will return a list of time stamp types supported by the adapter and OS. If either PCAP_TSTAMP_ADAPTER or PCAP_TSTAMP_ADAPTER_UNSYNCED are available, you will want to make libpcap use one of those. To do so, use pcap_set_tstamp_type() to set the time stamp type before calling pcap_activate().

NOTE: the time stamps you get might not be represented as seconds that have elapsed since January 1, 1970, 00:00:00 UTC; they might differ from that value by a few seconds (whatever the difference was between TAI and UTC at some point in time - I'd have to check the Precision Time Protocol spec to see what that offset is). This Is A Bug, and I will try to fix it at some point, if there's a way to determine whether adapter-supplied time stamps in Linux are based on the UN*X epoch or on some TAI epoch.