ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Timestamp Skew

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 15 Jan 2010 15:20:28 -0800
On Jan 15, 2010, at 3:04 PM, Gianluca Varenni wrote:

> It's not documented, and depends on the version of Windows, the service 
> pack, and the HAL type... Most of the times it's a non-compensated RDTSC, 
> however.

If it's just RDTSC, wouldn't it have the same problems on "SpeedStep machines" as raw RDTSC?  The description in the mail was

> Possible values are
>   a.. 0 (default) -> Timestamps generated through KeQueryPerformanceCounter, less reliable on SMP/HyperThreading machines, precision = some microseconds 
>   b.. 2 -> Timestamps generated through KeQuerySystemTime, more reliable on SMP/HyperThreading machines, precision = scheduling quantum (10/15 ms) 
>   c.. 3 -> Timestamps generated through the i386 instruction RDTSC, less reliable on SMP/HyperThreading/SpeedStep machines, precision = some microseconds

Also, should it say "machines where the clock rate is variable" or something such as that?  I don't know whether Intel still calls it "SpeedStep", and AMD have their own names for it.