Home // International Journal On Advances in Software, volume 4, numbers 1 and 2, 2011 // View article
Authors:
Peter Orosz
Tamas Skopko
Keywords: libpcap; timestamp resolution; inter-arrival time; Linux kernel; high speed network
Abstract:
Widely used network measurement applications, such as tcpdump and Wireshark, use the same common libpcap packet capture library. Libpcap assigns a 10-6 second precision timestamp to all processed frames. Higher physical bandwidth implies shorter inter-arrival times between consecutive frames. Accordingly timestamp precision must be proportional to the link speed. The latest version 1.1.x of libpcap provides 10-6 second native resolution, however pcap format supports a larger 2 x 32-bit timestamp value for each stored packet. On Gigabit Ethernet or faster networks, a timestamp resolution that works in the microsecond domain may not enable us to precisely reproduce the time-domain relation between consecutive frames. Therefore overall analysis of the data transmission could lead to a false result. For packet capturing with libpcap, it is assumed that the timestamp represents the time moment when a frame reaches the kernel’s input packet queue. In an idealized case generated timestamps are always converging and suitably close to the real arrival or transmission time of each frame so as to conserve the original inter-arrival time values. The timestamp resolution of network measurement applications must be increased according to the requirements of advanced high speed data networks. In our paper we are going to show and evaluate an alternative libpcap-based solution that features nanosecond precision timestamping.
Pages: 181 to 188
Copyright: Copyright (c) to authors, 2011. Used with permission.
Publication date: September 15, 2011
Published in: journal
ISSN: 1942-2628