[Oisf-users] Packet timestamps
lists at unx.ca
Mon Aug 1 15:53:42 UTC 2016
On Mon, Aug 1, 2016 at 2:11 AM, Blair Steven
<Blair.Steven at alliedtelesis.co.nz> wrote:
> The guys on my team are working on a custom source / runmode, and have a couple of questions about the Packet timestamp for those in the know:
> 1) What resolution is required for the timestamp? We attempted to use gettimeofday to obtain the microsecond accuracy that the other sources use, but this had a large performance impact (the processor we are using doesn't have an accelerated gettimeofday).
Try one second if you can, see how it works. Others may chime in with
reasons why 1 second might not be enough.
> 2) If we were to leave the timestamp unset (everything stamped with the same zero value) what would we expect to go wrong? From what I can see log messages might be generated incorrectly, but I'm a bit nervous about long running flows that need to be tracked / timed out perhaps.
The timestamp on the packet is used as the time source for many parts
of the engine - TCP stream reassembly, various timeouts, etc. So not
setting timestamps is not recommended and would have adverse affacts.
Does your hardware perhaps timestamps the packets?
More information about the Oisf-users