Remote nsec TimeStamps using PF_RING and cPacket Devices

Posted · Add Comment

PF_RING supports nsec timestamps from some modern NICs, such as those based on the Intel 82580 (e.g. Silicom PE2G4i80). But NIC timestamps require installing and running the application on the machine where the adapter is installed.
Furthermore, by the time the traffic gets from the wire to the the NIC, its temporal behavior might have been altered by queuing, buffering, and switching caused by SPAN ports or aggregation devices.

cPacket offers products that deliver nanosecond accurate timestamps directly from the wire, before switching, queuing, or bufffering. cPacket inline hardware probes are passive and transparent. They deliver precise nanosecond timestamps, which reflect the actual traffic behavior in real time.

The hardware time stamp is snapped by the cPacket inline probe, directly at the wire as soon as the packet data hits the physical interface. The cPacket probe augments the original packet with the hardware time stamp, by attaching it to to the end of the Ethernet frame (extra 12 bytes) as follows:

<4 bytes epoch time (seconds)><4 bytes fractional time (nanoseconds)><4 bytes reserved>

PF_RING has been extended to recognize cPacket timestamps, strip them off to recover the original packet, and set the kernel data structures (skbuff). This means that these “hardware timestamps directly from the wire” can be seamlessly available for any user space applications.

To demonstrate this technology out of the box, we created a software
package (cpacket_ts.tgz) that contains:

  • ixgbe driver (both in source and binary format for Ubuntu 10.10 server and RedHat EL 6 x84)
  • Enhanced tcpdump application that uses the precise hardware timestamps natively
  • n2disk, packet-to-disk application that can efficiently dump packets on disk in pcap format, which includes the accurate hardware time stamp in common pcap file, which can be used by other applications like Wireshark.

The source code used to generate the package (beside the unreleased n2disk application) is part of the PF_RING project.

For more information please refer to the cPacket press release.