2

I can see the timestamp in Wireshark which ranges up to nanoseconds. But I was just wondering whether it can sense nanoseconds cause in my trace I can't see any activities in the nanosecond range, they all are just 000!

enter image description here

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 18:12
3

The software only shows what the nic "sees". The precision of the timing can actually depend on settings in Wireshark, the network card, the network card driver and it can even seem like diffrent OS's can make a difference but I think that's because of the drivers. But, there are timing preferences in the software to show you that Wireshark does indeed go to the nanosecond. Showing the preferences info below just to show it can go to nanosecond and that you can adjust the timing preference itself.

I copied the below info from Wireshark. See the full site by clicking here

Precision example: If you have a timestamp and it’s displayed using, “Seconds Since Previous Packet”, : the value might be 1.123456. This will be displayed using the “Automatic” setting for libpcap files (which is microseconds). If you use Seconds it would show simply 1 and if you use Nanoseconds it shows 1.123456000.

6.12.1. Packet time referencing

The user can set time references to packets. A time reference is the starting point for all subsequent packet time calculations. It will be useful, if you want to see the time values relative to a special packet, e.g. the start of a new request. It’s possible to set multiple time references in the capture file.

The time references will not be saved permanently and will be lost when you close the capture file.

Time referencing will only be useful if the time display format is set to “Seconds Since Beginning of Capture”. If one of the other time display formats are used, time referencing will have no effect (and will make no sense either).

To work with time references, choose one of the Time Reference items in the Editmenu or from the pop-up menu of the “Packet List” pane. See Section 3.6, “The “Edit” menu”.

Set Time Reference (toggle) Toggles the time reference state of the currently selected packet to on or off.Find Next Find the next time referenced packet in the “Packet List” pane.Find Previous Find the previous time referenced packet in the “Packet List” pane.

Figure 6.11. Wireshark showing a time referenced packet

enter image description here

A time referenced packet will be marked with the string REF in the Time column (see packet number 10). All subsequent packets will show the time since the last time reference.

  • I am just keen to get the differences in the scale of nano second. So that I can exactly and precisely get the 4-time stamps of a ping command (Round trip time, two stamps in one pc and the two in the others) to calculate the offsets between two computer time. – Fida Hasan Sep 1 '17 at 8:57
  • 1
    Ping is not a reliable tools for measuring RTT. Ping may be influenced by QoS, filters, policy-based routing, stack optimization, command planes being slower than forwarding planes (for network devices), and so on. – Zac67 Sep 1 '17 at 10:54
1

Wireshark's timestamp code uses nanosecond resolution internally and the pcapng and pcap file formats can store nanosecond timestamps. Whether or not you a) get ns timestamps when you capture and b) those timestamps are in any way accurate depends on your hardware and other factors. You probably won't get accurate nanosecond timestamps from a standard NIC but you definitely can with some high-end NICs and purpose-built hardware such as network taps and capture appliances.

  • The timestamp is not generated by the NIC; so a high-end NIC doesn't increase resolution. – Zac67 Sep 2 '17 at 1:51
  • "High-end NIC" in this case doesn't mean "fast server NIC". It means "NIC specifically designed for packet capture". As the row titled "Hardware Timestamps" on the PF_RING page indicates, most of them do indeed support hardware timestamps. Typically this is done using an external source such as PTP, GPS PPS, or IRIG. Timestamp values are usually added to each frame in a special header or trailer. – Gerald Combs Sep 3 '17 at 21:13
  • Thanks for pointing that out - I used to be familiar with NDIS, apparently I'm not up to date... – Zac67 Sep 3 '17 at 21:17
  • No worries. There are very clever people approaching the problem from both the dedicated hardware and software + commodity hardware sides, and they're continually changing the state of the art. – Gerald Combs Sep 3 '17 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.