[prev in list] [next in list] [prev in thread] [next in thread] 

List:       winpcap-users
Subject:    Re: [Winpcap-users] timestamp
From:       "Gianluca Varenni" <gianluca.varenni () cacetech ! com>
Date:       2010-09-14 15:23:22
Message-ID: 6F714BE698B847B883BAC7EB155685EC () NELSON3
[Download RAW message or body]

The return value of QuerySystemTime and QueryPerformanceCounter is 
synchronized at the beginning of the capture (to compute the offset between 
epoch time and QueryPerformanceCounter), and then the counter and frequency 
returned by QPC are used to compute the number of seconds (and microseconds) 
and added to the offset.

The timestamping code is available in the source code of WinPcap, 
winpcap\packetntx\driver\time_calls.h

Have a nice day
GV



--------------------------------------------------
From: "Jan Martinec" <martij12@fel.cvut.cz>
Sent: Tuesday, September 14, 2010 7:23 AM
To: <winpcap-users@winpcap.org>
Subject: [Winpcap-users] timestamp

> Hello!
> I've got a question about timestamping method. I know that a timestamp
> is got using method QueryPerformanceCounter (resp.
> keQueryPerformanceCounter), which is a number of ticks of Performance
> counter. But timestamp is by Winpcap returned in "Seconds since Epoch"
> format. So how is the recomputation done?
>
> Thank you very much
>
> Best regards,
> Jan Martinec
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users@winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users 

_______________________________________________
Winpcap-users mailing list
Winpcap-users@winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
[prev in list] [next in list] [prev in thread] [next in thread]