From owner-freebsd-net@FreeBSD.ORG Sat Sep 25 07:13:06 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8AC9516A4CE for ; Sat, 25 Sep 2004 07:13:06 +0000 (GMT) Received: from mail.iinet.net.au (mail-05.iinet.net.au [203.59.3.37]) by mx1.FreeBSD.org (Postfix) with SMTP id 0FC0343D48 for ; Sat, 25 Sep 2004 07:13:04 +0000 (GMT) (envelope-from darrenr@reed.wattle.id.au) Received: (qmail 8519 invoked from network); 25 Sep 2004 07:13:02 -0000 Received: from unknown (HELO firewall.reed.wattle.id.au) (203.217.38.241) by mail.iinet.net.au with SMTP; 25 Sep 2004 07:13:01 -0000 Received: (from root@localhost) by firewall.reed.wattle.id.au (8.11.0/8.11.0) id i8P7EXT20923; Sat, 25 Sep 2004 17:14:33 +1000 (EST) From: Darren Reed Message-Id: <200409250714.RAA28547@avalon.reed.wattle.id.au> In-Reply-To: <5A076AAC-01C9-11D9-8193-000A958097E4@alum.mit.edu> To: tcpdump-workers@lists.tcpdump.org Date: Sat, 25 Sep 2004 17:14:18 +1000 (EST) X-Mailer: ELM [version 2.4ME+ PL99d (25)] MIME-Version: 1.0 cc: freebsd-net@FreeBSD.org Subject: Re: [tcpdump-workers] [PATCH] Add ioctl to disable bpf timestamping X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Sep 2004 07:13:06 -0000 In some email I received from Guy Harris, sie wrote: > On Sep 8, 2004, at 2:26 AM, Bruce M Simpson wrote: > > > Here's a patch against 5.3 to add a per-instance switch which allows > > the user to specify if captured packets should be timestamped (and, > > if so, whether microtime() or the faster but less accurate > > getmicrotime() call should be used). > > This is probably a pointless optimization, as you probably relatively > rarely have multiple BPF devices bound to the same interface receiving > the bulk of the packets (as opposed to some daemon with a filter that > passes only the packets it's interested in), but would there be any > advantage to having "bpf_tap()" and "bpf_mtap()" fetch the time stamp > and pass that to "catchpacket()", so that in the case where there *is* > more than one tap, the time stamp is only fetched once? That makes sense and allows you to correllate packet time stamps from a daemon collecting packets with those you see in tcpdump output when you run that in parallel to make sure things are moving. Darren