Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue on Windows with timestamping types (frozen timestamps) #695

Closed
nikodul opened this issue Sep 5, 2023 · 2 comments
Closed

Issue on Windows with timestamping types (frozen timestamps) #695

nikodul opened this issue Sep 5, 2023 · 2 comments

Comments

@nikodul
Copy link

nikodul commented Sep 5, 2023

Describe the bug
On Windows, after testing on at least two computers, we figured out that activating certain timestamping types alter the behaviour of other timestamping types.
In the attached capture test (modified from the capture test program on the git), we open, capture and close a device several times, with different timestamping types.
Whereas the captured packets timestamping seem to work ok in the first round of timestamping types, switching back to PCAP_TSTAMP_HOST captures packets with frozen timestamps.

Restarting the program does not fix the problem: timestamps are frozen except with PCAP_TSTAMP_HOST_LOWPREC and PCAP_TSTAMP_HOST_HIPREC which still seem to work ok.

Only rebooting seems to re-enable correct timestamping with other types (e.g. PCAP_TSTAMP_HOST, PCAP_TSTAMP_HOST_HIPREC_UNSYNCED), until once again the faulty mode is activated (PCAP_TSTAMP_HOST_LOWPREC or PCAP_TSTAMP_HOST_HIPREC or both).

Note: once the issue affects the capture program sample, WireShark also reports frozen timestamps when used on the same interface.

To Reproduce
Steps to reproduce the behavior:

  1. Compile and run the test program (modified for the libpcap capturetest.c): capturetest.txt
    Rename from .txt to .c
  2. See error

See first analysis by @guyharris here:
the-tcpdump-group/libpcap#1219 (comment)

Expected behavior
Captured packets timestamps should not be identical on many subsequent captured packets.

Logs
test.log

Diagnostic information

@dmiller-nmap
Copy link
Contributor

The frozen timestamp looks to be about 68 hours prior to the others, which probably means it is a zero performance counter representing the system boot time. With the current driver, that means that the counter of capture handles requiring the performance counter timestamp type (the default) is zero or negative. I will look into bugs in the increment/decrement of this counter.

@dmiller-nmap
Copy link
Contributor

This issue should be resolved in Npcap 1.77.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants