[Oisf-users] Packet timestamps

[Jason Ish]

On Mon, Aug 1, 2016 at 2:11 AM, Blair Steven
<Blair.Steven at alliedtelesis.co.nz> wrote:
> Hello
>
> The guys on my team are working on a custom source / runmode, and have a couple of questions about the Packet timestamp for those in the know:
>
> 1) What resolution is required for the timestamp? We attempted to use gettimeofday to obtain the microsecond accuracy that the other sources use, but this had a large performance impact (the processor we are using doesn't have an accelerated gettimeofday).

Try one second if you can, see how it works.  Others may chime in with
reasons why 1 second might not be enough.

> 2) If we were to leave the timestamp unset (everything stamped with the same zero value) what would we expect to go wrong? From what I can see log messages might be generated incorrectly, but I'm a bit nervous about long running flows that need to be tracked / timed out perhaps.

The timestamp on the packet is used as the time source for many parts
of the engine - TCP stream reassembly, various timeouts, etc. So not
setting timestamps is not recommended and would have adverse affacts.

Does your hardware perhaps timestamps the packets?

Jason