Frame Arrival Time drift
Hi,
We run instances of dumpcap for long periods (weeks or months) on Dell 1U servers with Windows 10 or Windows 10 VMs. We are using WinPcap. Our understanding is that npf grabs the system time when loading and then maintains its own timestamp clock. The result is a steady drift away from the system clock.
I noticed that there is a --time-stamp-type option for dumpcap. I've tried listing supported timestamp types on my Dell XPS running Windows 10 but get nothing listed.
Is there a way to force npf to periodically check the system clock and resync its internal timestamp?
Does npcap address the issue of arrival time drift?
Thanks and regards...Paul
Comments
Have you read that post of @Jasper https://blog.packet-foo.com/2015/04/d...
As far as I know the clock isn't updated, and I don't think it can be forced to resync. I also assume that npcap doesn't help much, as it's primary design goal is to replace WinPCAP for nmap, not for high precision packet capture.
But I am sure @Guy Harris knows much more about this than I do :-)