Search code examples
tcpdump

tcpdump time precision how to?

I want to get tcpdump at low time resolution (at milliseconds) instead of default microseconds.

in tcpdump manual I got -j argument with acceptable precisions as 'host_lowprec' and 'host_hiprec'

tcpdump -i any -n -j host_lowprec "tcp"

I have 2 questions:

  1. host_lowprec = ? precision and host_hiprec = ? precision

  2. can I set precision to milliseconds or nanoseconds ? if yes how?

Solution

  • In answer to your first question:

    The tcpdump man page says of the -j option:

    -j tstamp_type
    --time-stamp-type=tstamp_type
    Set the time stamp type for the capture to tstamp_type. The names to use for the time stamp types are given in pcap-tstamp(7); not all the types listed there will necessarily be valid for any given interface.

    and the pcap-tstamp(7) man page says:

    ... The time stamp types are listed here; the first value is the #define to use in code, the second value is the value returned by pcap_tstamp_type_val_to_name() and accepted by pcap_tstamp_type_name_to_val().

    PCAP_TSTAMP_HOST - host
    Time stamp provided by the host on which the capture is being done. The precision of this time stamp is unspecified; it might or might not be synchronized with the host operating system's clock.

    PCAP_TSTAMP_HOST_LOWPREC - host_lowprec
    Time stamp provided by the host on which the capture is being done. This is a low-precision time stamp, synchronized with the host operating system's clock.

    PCAP_TSTAMP_HOST_HIPREC - host_hiprec
    Time stamp provided by the host on which the capture is being done. This is a high-precision time stamp; it might or might not be synchronized with the host operating system's clock. It might be more expensive to fetch than PCAP_TSTAMP_HOST_LOWPREC.

    PCAP_TSTAMP_ADAPTER - adapter
    Time stamp provided by the network adapter on which the capture is being done. This is a high-precision time stamp, synchronized with the host operating system's clock.

    PCAP_TSTAMP_ADAPTER_UNSYNCED - adapter_unsynced
    Time stamp provided by the network adapter on which the capture is being done. This is a high-precision time stamp; it is not synchronized with the host operating system's clock.

    Neither host_lowprec nor host_hiprec specify an exact precision. The precision set with -j does NOT affect the way time stamps are stored in a capture file; they will be stored as seconds and microseconds, unless you have a newer version of tcpdump that supports the --time-stamp-precision option and the OS can deliver nanosecond time stamps, in which case they will be stored as seconds and nanoseconds and the file will have a different "magic number" so that tcpdump/Wireshark/etc. can read the time stamps properly.

    All the -j option controls is how much of the microseconds (or nanoseconds) value is significant.

    In answer to your second question:

    There is no mechanism for storing times in pcap files as seconds and milliseconds, and there's no explicit option to request that the microseconds (or nanoseconds) value have only 3 significant figures.

    There is an option to request that the time stamps be stored as seconds and nanoseconds. If you are doing a live capture, this will work only if the operating system supports delivering seconds and nanoseconds time stamps when capturing; this currently only works on newer versions of Linux.

    What is it that you are trying to accomplish here?