incorrect timestamps in pcap's? #129

Closed
mredan opened this Issue Jul 24, 2014 · 2 comments

Comments

Projects
None yet
2 participants
@mredan

mredan commented Jul 24, 2014

when using netsniff-ng 0.5.8 like this:
netsniff-ng --in eth1 -H --ring-size 1GiB --out /pcaps -J --interval 500MiB --silent --verbose -b 0 -P dump

I seem to be getting bad timestamps on packets. The file names seem to have proper values, but the packets themselves appear to be roughly 160 seconds in the future.

as an example (packets are coming in at about 200mbit/sec on this interface at this time):
tcpdump -tt -nn -c 1 -r dump-1406168980.pcap
reading from file dump-1406168980.pcap, link-type EN10MB (Ethernet)
1406169137.537012 IP 5.5.5.5.46909 > 4.4.4.4.80: Flags [.], seq 1286243091:1286248931, ack 258445073, win 148, length 5840

The machine is NTP sync'd, and the hwclock is correct.

If I use tcpdump to write pcap files, the timestamps are accurate.

if I use netsniff-ng to grab packets from the loopback interface, the timestamps are accurate.

through some testing, it seems that if I disable hardware timestamping in netsniff-ng.c by commenting out these lines:
ret = set_sockopt_hwtimestamp(sock, ctx->device_in);
if (ret == 0 && ctx->verbose)
printf("HW timestamping enabled\n");

then the timestamps in pcap's become accurate.

the configure script detects that hw timestamping can be enabled.

I tried just disabling it in the configure script, but the above lines cause a linking error, hence why I commented it out.

I looked around for a way to disable hardware timestamping with ethtool..but could not see a way.

some details about this machine:
Ubuntu 12.0.4
kernel: 3.8.0-39-generic #58~precise1-Ubuntu SMP
NIC Intel I350
Driver igb version: 4.1.2-k

@tklauser

This comment has been minimized.

Show comment
Hide comment
@tklauser

tklauser Jul 25, 2014

Contributor

Thanks a lot for your report. From what you describe, this looks like a driver/kernel issue to me. I'll try to reproduce this here, but it might take some time as I currently don't have any NIC supporting HW timestamping available.

Meanwhile, I'd suggest adding a command-line option to disable HW timestamping to netsniff-ng. This should then at least work around the problem and might also be beneficial for other users. I'll do implement that some time later today...

Contributor

tklauser commented Jul 25, 2014

Thanks a lot for your report. From what you describe, this looks like a driver/kernel issue to me. I'll try to reproduce this here, but it might take some time as I currently don't have any NIC supporting HW timestamping available.

Meanwhile, I'd suggest adding a command-line option to disable HW timestamping to netsniff-ng. This should then at least work around the problem and might also be beneficial for other users. I'll do implement that some time later today...

tklauser added a commit that referenced this issue Jul 25, 2014

netsniff-ng: Add command line option to disable hardware time stamping
Allow to disable hardware time stamping using the command line switch
(-N/--no-hwtimestamp). This might be useful in situations where hardware
time stamps are skewed somehow.

Reference: #129
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>

tklauser added a commit that referenced this issue Aug 12, 2014

netsniff-ng: Add command line option to disable hardware time stamping
Allow to disable hardware time stamping using the command line switch
(-N/--no-hwtimestamp). This might be useful in situations where hardware
time stamps are skewed somehow.

Reference: #129
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>

@tklauser tklauser added the need-info label Oct 20, 2017

@tklauser

This comment has been minimized.

Show comment
Hide comment
@tklauser

tklauser Oct 20, 2017

Contributor

Closing due to age. Feel free to reopen in case this is still an issue.

Contributor

tklauser commented Oct 20, 2017

Closing due to age. Feel free to reopen in case this is still an issue.

@tklauser tklauser closed this Oct 20, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment