Tutorial: Timestamp Nano/Micro Seconds

Introduction

As most interfaces produce 10-100GBit/s bandwidth it make sense to switch to a nano second timestamp. How to switch beteen micro and nano second operations is described in the following chaper.

Preparation

First, restore T2 into a pristine state by removing all unnecessary or older plugins from the plugin folder ~/.tranalyzer/plugins and compile the following plugins:

$ t2build -e
Are you sure you want to empty the plugin folder '/home/wurst/.tranalyzer/plugins' (y/N)? y
Plugin folder emptied
$ t2build tranalyzer2 basicFlow tcpStates nFrstPkts txtSink
...
BUILD SUCCESSFUL

If you did not create a separate data and results directory yet, please do it now in another bash window, that facilitates your workflow:

$ mkdir ~/data ~/results
$

The anonymized sample PCAP used in this tutorial can be downloaded here: dhcp-nanosecond_stb.pcap Please extract it under your data folder. Now you are all set for T2 nanoseconds experience.

Switch to nanoseconds

The control constant TSTAMP_PREC for the core and plugin timestamp precision is residing in tranalyzer.h. The output format of the flow and packet files can be configurated separately in bin2txt.h. By default TSTAMP_PREC=0 and B2T_NANOSECS=0are set to microseconds. Let’s set the output to nano seconds but the core in usec.

Now run t2 on the pcap and look at the flow and the packet file:

$ t2conf tranalyzer2 -D B2T_NANOSECS=1
$ t2build -R
...
$ t2 -r ~/data/dhcp-nanosecond_stb.pcap -w results -s
================================================================================
Tranalyzer 0.8.9 (Anteater), Tarantula. PID: 11326
================================================================================
[INF] Creating flows for L2, IPv4, IPv6
[WRN] PCAP nanosecond-resolution: for improved precision, run 't2conf tranalyzer2 -D B2T_NANOSECS=1 -D TSTAMP_PREC=1 && t2build -R'
Active plugins:
    01: basicFlow, 0.8.9
    02: tcpStates, 0.8.9
    03: nFrstPkts, 0.8.9
    04: txtSink, 0.8.9
[INF] IPv4 Ver: 5, Rev: 16122020, Range Mode: 0, subnet ranges loaded: 406057 (406.06 K)
[INF] IPv6 Ver: 5, Rev: 17122020, Range Mode: 0, subnet ranges loaded: 50976 (50.98 K)
Processing file: /home/wurst/data/dhcp-nanosecond_stb.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1102274184.317453 sec (Sun 05 Dec 2004 19:16:24 GMT)
Dump stop : 1102274184.387798 sec (Sun 05 Dec 2004 19:16:24 GMT)
Total dump duration: 0.070345 sec
Finished processing. Elapsed time: 0.000186 sec
Finished unloading flow memory. Time: 0.000220 sec
Percentage completed: 100.00%
...
$

The end report time stamps are in microseconds. Have a look at the warning [WRN]. T2 tells you that there is nano sec precision available and what you should do to switch it on.

But first look at the output of the flow and packet file:

$ tcol dhcp-nanosecond_stb_flow.txt
%dir  flowInd  flowStat            timeFirst             timeLast              duration     numHdrDesc  numHdrs  hdrDesc       srcMac             dstMac             ethType  ethVlanID  srcIP        srcIPCC  srcIPOrg           srcPort  dstIP            dstIPCC  dstIPOrg           dstPort  l4Proto  tcpStates  nFpCnt  L2L3L4Pl_Iat
A     1        0x0500000000004000  1102274184.317453000  1102274184.387484000  0.070031000  1           3        eth:ipv4:udp  00:0b:82:01:fc:42  ff:ff:ff:ff:ff:ff  0x0800              0.0.0.0      -        "-"                68       255.255.255.255  11       "Broadcast"        67       17       0x00       2       272_0.000000000;272_0.070031000
A     2        0x0400000000004001  1102274184.317748000  1102274184.387798000  0.070050000  1           3        eth:ipv4:udp  00:08:74:ad:f1:9b  00:0b:82:01:fc:42  0x0800              192.168.0.1  07       "Private network"  67       192.168.0.10     07       "Private network"  68       17       0x00       2       300_0.000000000;300_0.070050000
$ 

All timestamps from basicFlow and nFrstPkts are now in nanoseconds format, but the last three digits are 0 as the internal values are still microsecondes. Same for the packet file below.

$ tcol dhcp-nanosecond_stb_packets.txt
%pktNo  flowInd  flowStat            time                  pktIAT    flowDuration  numHdrs  hdrDesc       ethVlanID  srcMac             dstMac             ethType  srcIP        srcIPCC  srcIPOrg         srcPort  dstIP            dstIPCC  dstIPOrg         dstPort  l4Proto  l7Content
1       1        0x0400000000004000  1102274184.317453055  0.000000  0.000000      3        eth:ipv4:udp             00:0b:82:01:fc:42  ff:ff:ff:ff:ff:ff  0x0800   0.0.0.0      -        -                68       255.255.255.255  11       Broadcast        67       17       ......=..........................B..........................................................................................................................................................................................................c.Sc5..=.......B2.....7....*........
2       2        0x0400000000004001  1102274184.317748000  0.000000  0.000000      3        eth:ipv4:udp             00:08:74:ad:f1:9b  00:0b:82:01:fc:42  0x0800   192.168.0.1  07       Private network  67       192.168.0.10     07       Private network  68       17       ......=............\n.............B..........................................................................................................................................................................................................c.Sc5........:.....;....N3.....6................................
3       1        0x0400000000004000  1102274184.387484000  0.070031  0.070031      3        eth:ipv4:udp             00:0b:82:01:fc:42  ff:ff:ff:ff:ff:ff  0x0800   0.0.0.0      -        -                68       255.255.255.255  11       Broadcast        67       17       ......=..........................B..........................................................................................................................................................................................................c.Sc5..=.......B2....\n6.....7....*..
4       2        0x0400000000004001  1102274184.387798000  0.070050  0.070050      3        eth:ipv4:udp             00:08:74:ad:f1:9b  00:0b:82:01:fc:42  0x0800   192.168.0.1  07       Private network  67       192.168.0.10     07       Private network  68       17       ......=............\n.............B..........................................................................................................................................................................................................c.Sc5..:.....;....N3.....6......................................
$ 

Now switch the core to nanoseconds.

$ t2conf tranalyzer2 -D TSTAMP_PREC=1
$ t2build -R
..
$ t2 -r ~/data/dhcp-nanosecond_stb.pcap -w results -s
================================================================================
Tranalyzer 0.8.9 (Anteater), Tarantula. PID: 12928
================================================================================
[INF] Creating flows for L2, IPv4, IPv6
Active plugins:
    01: basicFlow, 0.8.9
    02: tcpStates, 0.8.9
    03: nFrstPkts, 0.8.9
    04: txtSink, 0.8.9
[INF] IPv4 Ver: 5, Rev: 16122020, Range Mode: 0, subnet ranges loaded: 406057 (406.06 K)
[INF] IPv6 Ver: 5, Rev: 17122020, Range Mode: 0, subnet ranges loaded: 50976 (50.98 K)
Processing file: /home/wurst/dhcp-nanosecond_stb.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1102274184.317453055 sec (Sun 05 Dec 2004 19:16:24 GMT)
Dump stop : 1102274184.387798000 sec (Sun 05 Dec 2004 19:16:24 GMT)
Total dump duration: 0.070344945 sec
Finished processing. Elapsed time: 0.000206000 sec
Finished unloading flow memory. Time: 0.000234000 sec
Percentage completed: 100.00%
...
$

Now all core time stamps switched to nanoseconds and in the flow file some last three digits show now non zeor values.

$ tcol dhcp-nanosecond_stb_flow.txt %dir flowInd flowStat timeFirst timeLast duration numHdrDesc numHdrs hdrDesc srcMac dstMac ethType ethVlanID srcIP srcIPCC srcIPOrg srcPort dstIP dstIPCC dstIPOrg dstPort l4Proto tcpStates nFpCnt L2L3L4Pl_Iat A 1 0x0400000000004000 1102274184.317453055 1102274184.387484000 0.070030945 1 3 eth:ipv4:udp 00:0b:82:01:fc:42 ff:ff:ff:ff:ff:ff 0x0800 0.0.0.0 - “-” 68 255.255.255.255 11 “Broadcast” 67 17 0x00 2 272_0.000000000;272_0.070030945 A 2 0x0400000000004001 1102274184.317748000 1102274184.387798000 0.070050000 1 3 eth:ipv4:udp 00:08:74:ad:f1:9b 00:0b:82:01:fc:42 0x0800 192.168.0.1 07 “Private network” 67 192.168.0.10 07 “Private network” 68 17 0x00 2 300_0.000000000;300_0.070050000 $ ```

Same for the packet file

$ tcol dhcp-nanosecond_stb_packets.txt
%pktNo  flowInd  flowStat            time                  pktIAT    flowDuration  numHdrs  hdrDesc       ethVlanID  srcMac             dstMac             ethType  srcIP        srcIPCC  srcIPOrg         srcPort  dstIP            dstIPCC  dstIPOrg         dstPort  l4Proto  l7Content
1       1        0x0400000000004000  1102274184.317453055  0.000000  0.000000      3        eth:ipv4:udp             00:0b:82:01:fc:42  ff:ff:ff:ff:ff:ff  0x0800   0.0.0.0      -        -                68       255.255.255.255  11       Broadcast        67       17       ......=..........................B..........................................................................................................................................................................................................c.Sc5..=.......B2.....7....*........
2       2        0x0400000000004001  1102274184.317748000  0.000000  0.000000      3        eth:ipv4:udp             00:08:74:ad:f1:9b  00:0b:82:01:fc:42  0x0800   192.168.0.1  07       Private network  67       192.168.0.10     07       Private network  68       17       ......=............\n.............B..........................................................................................................................................................................................................c.Sc5........:.....;....N3.....6................................
3       1        0x0400000000004000  1102274184.387484000  0.070031  0.070031      3        eth:ipv4:udp             00:0b:82:01:fc:42  ff:ff:ff:ff:ff:ff  0x0800   0.0.0.0      -        -                68       255.255.255.255  11       Broadcast        67       17       ......=..........................B..........................................................................................................................................................................................................c.Sc5..=.......B2....\n6.....7....*..
4       2        0x0400000000004001  1102274184.387798000  0.070050  0.070050      3        eth:ipv4:udp             00:08:74:ad:f1:9b  00:0b:82:01:fc:42  0x0800   192.168.0.1  07       Private network  67       192.168.0.10     07       Private network  68       17       ......=............\n.............B..........................................................................................................................................................................................................c.Sc5..:.....;....N3.....6......................................
$

That’s it, don’t forget to reset TSTAMP_PREC for the next tutorials and recompile

$ t2conf tranalyzer2 i-D B2T_NANOSECS=0 -D TSTAMP_PREC=0
$ t2build -R 
..
$

Have fun!