Message-Id: <200112042145.fB4Lj7q10210@picard.cs.ohiou.edu> From: "Shawn Ostermann" <ostermann@cs.ohiou.edu> Subject: Re: Timestamping Accuracy Date: Tue, 04 Dec 2001 16:45:07 -0500
>> Supposing one had modified their computer with a very accurate time source
>> (say using a GPS receiver to obtain a stratum 1 clock and had installed a
>> very accurate crystal oscillator), and had accounted for all other sources
>> of variance in the computers internals (interrupts and so forth), what is
>> the best possible accuracy that could be obtained using TCPtrace on a
>> Gigabit ethernet segment?
>>
>> I suppose the real question is this: at what point in the TCP trace
>> program is the timestamp applied?
Well, that depends on where the info came from. Not all of the packet
grabbing programs that tcptrace can read record with the same
accuracy. Netscout, for example, only stores milliseconds. If you're
using tcpdump's pcap save format, then you get a 32-bit microsecond
counter. How many of those bits are actually significant is up to the
tcpdump/pcap implementation that saved the file.
Tcptrace uses microsecond accuracy throughout (by only manipulating
Unix timeval's regardless of where the data came from). In older
versions, graphing was only done to millisecond accuracy, but that was
changed to microsecond (6 digits past seconds) throughout.
>> Again assuming a GbE network, a minimum size frame (TCP connection
>> packet) would be 66 bytes (528 bits). At 1e9 bits per second, it
>> takes about .5 microsecond to transmit the frame. At the opposite
>> end of the spectrum, a jumbo frame of size 9,000 bytes (72,000
>> bits) would take about 72 microseconds. If the timestamp were
>> always applied at the end of transmission it would be a source of
>> significant variance. However, if it were always applied at the end
>> of the TCP header it would be consistent.
I understand what you're saying. I can't honestly say that I have any
idea of how pcap, for example, timestamps files. I would assume that
it's always done after the file has been fully received.
--sdo
----------------------------------------------------------------------------
To unsubscribe, send a message with body containing "unsubscribe tcptrace" to
majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 12/05/01 EST