From owner-freebsd-net@FreeBSD.ORG Wed Sep 8 19:00:32 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E411C16A4D3 for ; Wed, 8 Sep 2004 19:00:32 +0000 (GMT) Received: from mail-out3.apple.com (mail-out3.apple.com [17.254.13.22]) by mx1.FreeBSD.org (Postfix) with ESMTP id A972143D53 for ; Wed, 8 Sep 2004 19:00:32 +0000 (GMT) (envelope-from guy@alum.mit.edu) Received: from mailgate1.apple.com (a17-128-100-225.apple.com [17.128.100.225]) by mail-out3.apple.com (8.12.11/8.12.11) with ESMTP id i88J3NUL026847 for ; Wed, 8 Sep 2004 12:03:23 -0700 (PDT) Received: from relay4.apple.com (relay4.apple.com) by mailgate1.apple.com ; Wed, 8 Sep 2004 12:00:32 -0700 Received: from [17.202.40.208] (gharris.apple.com [17.202.40.208]) by relay4.apple.com (8.12.11/8.12.11) with ESMTP id i88J0UZw005243; Wed, 8 Sep 2004 12:00:30 -0700 (PDT) In-Reply-To: <20040908092624.GD793@empiric.icir.org> References: <20040908092624.GD793@empiric.icir.org> Mime-Version: 1.0 (Apple Message framework v619) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <5A076AAC-01C9-11D9-8193-000A958097E4@alum.mit.edu> Content-Transfer-Encoding: 7bit From: Guy Harris Date: Wed, 8 Sep 2004 12:00:29 -0700 To: tcpdump-workers@lists.tcpdump.org X-Mailer: Apple Mail (2.619) cc: freebsd-net@FreeBSD.org Subject: Re: [tcpdump-workers] [PATCH] Add ioctl to disable bpf timestamping X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Sep 2004 19:00:33 -0000 On Sep 8, 2004, at 2:26 AM, Bruce M Simpson wrote: > Here's a patch against 5.3 to add a per-instance switch which allows > the user to specify if captured packets should be timestamped (and, > if so, whether microtime() or the faster but less accurate > getmicrotime() call should be used). This is probably a pointless optimization, as you probably relatively rarely have multiple BPF devices bound to the same interface receiving the bulk of the packets (as opposed to some daemon with a filter that passes only the packets it's interested in), but would there be any advantage to having "bpf_tap()" and "bpf_mtap()" fetch the time stamp and pass that to "catchpacket()", so that in the case where there *is* more than one tap, the time stamp is only fetched once? That has the "disadvantage" that a tap might get a more accurate time stamp than it needs (the most accurate time stamp requested by a BPF device would be the one used). > Comments/flames/etc to the usual... If this is generally accepted as a good idea, it might be worth mentioning it to the other BSDs.