The timestamps are generated by the capture library (npcap on windows, libpcap on other systems). The path a packet travels before it reaches the capture library can involve some buffers (I bet there are buffers on the USB-RJ45 interface itself, as well as some buffering in the driver for the USB-RJ45 interface). So when a burst of buffered packets pass the capture library, they can end up having the same timestamp.
Also, there are multiple timestamping options in WIndows, there is a trade-off between accuracy and precision. One mode is more accurate, but less precies (it uses 10/15 ms timeticks) and the other one is more precise (microsecond precision IIRC), but it can drift from the system clock a little bit over time. So if you use the "accurate" mode, all packets received in a 10/15 ms interval will get the same timestamp. See also: https://github.com/nmap/npcap/issues/583
Asked: 2023-02-02 19:13:57 +0000
Seen: 309 times
Last updated: Feb 03 '23
It is safe to say that we don't know.
My guess however would be that the USB driver gets them all at once from the adapter and that is the timestamp that is relevant for your machine.USB ethernet devices are not on my list of best tools for the job.but sometims you have to go with what you have.