Precision of timestamps on monitored packets?

[Jon-Olov Vatn]

Hi!

I am using the hostap driver in monitor mode to monitor WLAN traffic
with tcpdump (and also ethereal), and I wonder if someone knows what
precision these measured arrival time timestamps have. To improve the
accuracy I have calibrated the system clock (with methods described in
the linux "Clock mini-HOWTO"), but how to estimate the precision (the
random errors) I do not know. Any hints or comments on this is
appreciated.

Some background information:
----------------------------
I am not sure how/when monitored packets are timestamped. A friend
told me that he thought that the WLAN card had their own clock (or
counter) that timestamped the packets upon arrival. If anyone has
information about how this works or hints of where I could read about
it it would be great! I tried to look for information about it in the
mail archieve, but without success (I suspect that questions about
this has been asked before, but I just could not find it).

I also started to look for the answer in the hostap source code. In
the file "hostap_hw.c" there is a function called "prism2_rx_80211()"
using both a "hosttime" and the "mactime". I guess that the "mactime"
is set to some time counter value maintained by the WLAN card. If I
configure my WLAN card to monitor type "ARPHDR_IEEE80211" I am able to
see both the "hosttime" and the "mactime" with ethereal, but I could
not see if any of them corresponds to the arrival time reported by
ethereal.

So far I have been using the arrival time reported by tcpdump (or
ethereal) when performing my measurements. Does anyone know if the
reported arrival time corresponds to the "hosttime" or the "mactime"
(or something else)? Any additional information on this matter is of
course welcome!

Best wishes,


Jon-Olov Vatn


P.S. For monitoring I am using HostAP 2002-10-12 release. I do not
know if the files concerning timestamping of received packets (such as
"hostap_hw.c" have changed lately. D.S.