Yes, we have an option for 1588 timestamps, but it requires some extra code to enable. I plan to add that feature in the future.

Regards,
-Ken

From: Victor Julien [mailto:notifications@github.com]
Sent: Thursday, July 25, 2013 5:24 AM
To: inliniac/suricata
Cc: Kenneth Steele
Subject: Re: [suricata] Initial Tile mPIPE support (#462)


In src/source-mpipe.c:

> + * \param pkt pointer to current packet

> + */

> +static inline

> +Packet *MpipeProcessPacket(MpipeThreadVars *ptv, gxio_mpipe_idesc_t *idesc)

> +{

> +    int caplen = idesc->l2_size;

> +    u_char *pkt = gxio_mpipe_idesc_get_va(idesc);

> +    Packet *p = (Packet *)(pkt - sizeof(Packet) - headroom/*2*/);

> +

> +    PACKET_RECYCLE(p);

> +    PKT_SET_SRC(p, PKT_SRC_WIRE);

> +

> +    ptv->bytes += caplen;

> +    ptv->pkts++;

> +

> +    gettimeofday(&p->ts, NULL);

Doesn't your capture lib provide a timestamp?

—
Reply to this email directly or view it on GitHub<https://github.com/inliniac/suricata/pull/462/files#r5393883>.