Import and export PCAP files with nanosecond timestamps

Ostinato has supported importing and exporting PCAP files since 2011. In 2020, I added support to import non-PCAP format (e.g. pcapng) capture files by converting them to PCAP files internally.

Ostinato customer Orhan recently reached out to me to investigate why an imported PCAP file when exported back to PCAP after editing the packets in Ostinato had incorrect timestamps.

After debugging, I found that this was due to the input pcap file having nanosecond precision timestamps while Ostinato only supports microsecond precision timestamps (the original PCAP format) — in some cases.

While a nanosecond PCAP was imported correctly in intelligent mode and would replay with the same nanosecond accuracy to the extent possible, saving a PCAP always used microsecond timestamps.

A nanosecond PCAP file imported in raw (aka non-intelligent) mode lost its nanosecond precision and fell back to using microsecond timestamps.

Starting v1.2, Ostinato saves PCAP files with nanosecond precision timestamps. Also, importing a nanosecond pcap in raw mode is now natively supported without losing the timestamp precision.

Note: Packet captures triggered from Ostinato, however, still use microsecond precision - this will be changed in a future version. A workaround, for now, is to directly use tcpdump (--time-stamp-precision=nano) or tshark (--time-stamp-type <type>) for capturing packets. Note that the NIC, OS and libpcap version (>= 1.0) should support nanosecond timestamps - many of them don’t.

For more Ostinato related content, subscribe for email updates.