Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

question how to timestamp end of packet #61

Open
horsth opened this issue Apr 5, 2019 · 2 comments
Open

question how to timestamp end of packet #61

horsth opened this issue Apr 5, 2019 · 2 comments
Labels
pcapv3 aka pcapng

Comments

@horsth
Copy link

horsth commented Apr 5, 2019

Is there a way in the pcapng format to provide a second timestamp for a packet?
I am looking at an RS485 UART serial protocol. Packets can have different BAUD rates and different delays between single Bytes. For analysing the protocol it is important to know the time gap between the end of one packet and the start of the next packet. So my question is whether a standard way exists in pcapng to have a second timestamp in a packet for the end of transmission.

@guyharris
Copy link
Collaborator

There isn't a standard way to do that.

The pcapng format doesn't explicitly indicate what the timestamp represents; it just speaks of it as a timestamp.

And many of the capture mechanisms that provide packets to put into pcapng files don't specify that, either; packets are typically captured on network interfaces managed by the host OS's networking stack, and the timestamp of a packet is the time at which the part of the network interface that adds timestamps to packets sees the packet. This can be - and usually is - some unknown amount of time after the last bit of the packet reached the network adapter when receiving packets. When the packet is sent by the host doing the packet capture, it's some unknown amount of time before the first bit of the packet is transmitted by the network adapter.

If your protocol will require a new LINKTYPE_/DLT_ value to put it in a pcapng (or pcap) file, I would suggest having the packets begin with a pseudo-header giving both the start time and the end time of the packet, unless you choose to make one of those times be the timestamp in the pcapng EPB.

@guyharris
Copy link
Collaborator

An alternative would be to add an "end-of-packet timestamp" option to the pcapng Enhanced Packet Block, with the same timestamp format as the packet timestamp. (This obviously wouldn't apply to pcap, which does not have per-packet options.)

The same caveats stated in the previous paragraph would apply to the end-of-packet timestamp as well.

@mcr mcr added the pcapv3 aka pcapng label Aug 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pcapv3 aka pcapng
Projects
None yet
Development

No branches or pull requests

3 participants