Re: Where are incoming packets timestamped at

[Fabrizio Giordano <Fabrizio.Giordano () riverbed com>]

What I'm trying to do is to eliminate the timestamping time-overhead cos I need to test if that operation reduces 
performance. Therefore I guess that what I have to do is to disable the code in af_packet.c *AND* the code in 
core/dev.c, right?
Thank you very much!

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org [mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Guy 
Harris
Sent: Thursday, August 18, 2011 5:47 PM
To: tcpdump-workers () lists tcpdump org
Subject: Re: [tcpdump-workers] Where are incoming packets timestamped at


On Aug 18, 2011, at 2:04 PM, Fabrizio Giordano wrote:

> Disabling net_timestamp() in net/core/dev.c was one of the first things I tried, among with disabling other 
> "get_timestamp"-like functions. But apparently that's not where packes get timestamped.

It is, but it's not the *only* place where they get timestamped.

> Nuno's suggestion turned out to be what I was looking for. Packets are actually timestamped in the function 
> tpacket_rcv in net/packet/af_packet.c

No, the place where packets get timestamped *if they don't already have a time stamp* is there.

The code, at least in my 2.6.32.4 source, is:

                if (skb->tstamp.tv64)
                        tv = ktime_to_timeval(skb->tstamp);
                else
                        do_gettimeofday(&tv);
                h.h1->tp_sec = tv.tv_sec;
                h.h1->tp_usec = tv.tv_usec;

and

                if (skb->tstamp.tv64)
                        ts = ktime_to_timespec(skb->tstamp);
                else
                        getnstimeofday(&ts);
                h.h2->tp_sec = ts.tv_sec;
                h.h2->tp_nsec = ts.tv_nsec;

If the packet has already been given a time stamp, skb->tstamp.tv64 will be non-zero, and it'll call 
ktime_to_timeval(skb->tstamp) to convert that time stamp to a "struct timeval" or call ktime_to_timespec() to convert 
it to a "struct timespec" and use that for the time stamp.

If your goal is to avoid all time stamping of packets, it's *necessary* to eliminate that code, but it's not 
*sufficient* to eliminate that code.  If you're just trying to throw away the time stamp information that lower-level 
code has already added to the packet, it's sufficient to eliminate that code, but I don't see what the *point* of doing 
so is - it's not as if it's going to keep the system from spending time to read the system clock for every packet.

What is it you're trying to do here?-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.