Return to BSD News archive
Xref: sserve comp.sys.sun.hardware:9250 comp.sys.sun.misc:8662 comp.sys.sun.admin:15358 comp.dcom.lans.ethernet:4559 comp.unix.bsd:12251 comp.unix.sys5.r4:3518
Path: sserve!newshost.anu.edu.au!munnari.oz.au!news.Hawaii.Edu!ames!haven.umd.edu!uunet!utcsri!csri.toronto.edu!wayne
Newsgroups: comp.sys.sun.hardware,comp.sys.sun.misc,comp.sys.sun.admin,comp.dcom.lans.ethernet,comp.unix.bsd,comp.unix.sys5.r4
From: wayne@csri.toronto.edu (Wayne Hayes)
Subject: Who updates SunOS kernel variable 'time'?
Message-ID: <1993Jul12.150108.8036@jarvis.csri.toronto.edu>
Organization: CSRI, University of Toronto
Date: 12 Jul 93 19:01:09 GMT
Lines: 34
I have been spending a few days trying to find the answer to a very simple
question: I want to know precisely what time is represented by the
timestamp that tcpdump(1) gives to it's packets. Specifically, I want
to know if the time (which tcpdump(1) prints to the microsecond, although
it warns this may be optimistic) represents the time the *beginning* of
the packet was received, or the time the *end* of it was received (which
can differ by up to 1.2 ms for the longest ethernet packets).
The quest has led me through the manual pages for tcpdump, then it's
source; then the man pages for NIT and other various network and kernel
and IOCTL interfaces, and finally to the kernel sources. I have tracked
down tcpdump's timestamp to the NIT's 'struct timeval nh_timestamp',
which is set in the kernel file 'net/nit.c', function nit_fillhdr,
to the line "nh->nh_timestamp = time;". This implies that there is
a kernel variable somewhere with the declaration "struct timeval time".
I have search the entire kernel source tree without finding this declaration!
Where is it? Who updates it, and how often?
The above line ("nh->nh_timestamp = time;") leads me to believe that
the timestamp represents the time of reciept of the *end* of the packet;
probably when some hardware causes an interupt saying "here's a complete
packet". But some more info would be greatly appreciated.
Please e-mail responses; I don't think there are very many people who
are interested in the response. Nevertheless I'll post one summary
whenever I get the answer. If you insist on posting, you may want to
trim a few newsgroups off my copious Newsgroups: line.
--
If the Earth is the size of a pea in New York, then the Sun is a beachball 50m
away, Pluto is 2km away, and the next nearest star is in Tokyo. Now shrink
Pluto's orbit into a coffee cup; then our Milky Way Galaxy fills North America.
Wayne Hayes INTERNET: wayne@csri.utoronto.ca CompuServe: 72401,3525