Endace DAG 5.2X, User Manual

Page: 47 / 66

EDM01-33v1 DAG_7.5G4_Card_User_Guide
©2008 Endace Technology Ltd. Confidential - Version 1 - November 2008 43
Timestamps
ERF files contain a hardware generated timestamp of each packet’s arrival.
The format of this timestamp is a single little-endian 64-bit fixed point number, representing
the number of seconds since midnight on the 1
st
January 1970.
The high 32-bits contain the integer number of seconds, while the lower 32-bits contain the
binary fraction of the second. This allows an ultimate resolution of 2
-32
seconds, or
approximately 233 picoseconds.
Different DAG cards have different actual resolutions. This is accommodated by the lower
most bits that are not active being set to zero. In this way the interpretation of the timestamp
does not need to change when higher resolution clock hardware is available. The DAG 7.5G4
implements the 27 most significant bits which provides a time resolution of 7.5 nanoseconds.
The ERF timestamp allows you to find the difference between two timestamps using a single
64-bit subtraction. You do not need to check for overflows between the two halves of the
structure as you would need to do when comparing Unix time structures.
Example
Below is example code showing how a 64-bit ERF timestamp (erfts) can be converted into a
struct timeval
representation (tv):
unsigned long long lts;
struct timeval tv;
lts = erfts;
tv.tv_sec = lts >> 32;
lts = ((lts & 0xffffffffULL) * 1000 * 1000);
lts += (lts & 0x80000000ULL) << 1; /* rounding */
tv.tv_usec = lts >> 32;
if(tv.tv_usec >= 1000000) {
tv.tv_usec -= 1000000;
tv.= 1;
}