title: How do I turn on nanosecond precision when capturing live traffic?
body: <p><strong>How do I tell libpcap v1.6.2 to store nanosecond values in <code>struct pcap_pkthdr::ts.tv_usec</code> (instead of microsecond values) when capturing live packets?</strong></p>
  
  <p><sup>(Note:  This question is similar to <a href="https://stackoverflow.com/questions/25502139/how-to-enable-nanosecond-resolution-when-capturing-live-packets-in-libpcap">How to enable nanosecond resolution when capturing live packets in libpcap?</a> but that question is vague enough that I decided to ask a new question.)</sup></p>
  
  <p>For offline and "dead" captures, the following functions can be used to tell libpcap to fill the <code>struct pcap_pkthdr</code>'s <code>ts.tv_usec</code> member with nanosecond values:</p>
  
  <ul>
  <li><a href="http://www.tcpdump.org/manpages/pcap_open_dead.3pcap.html" rel="nofollow"><code>pcap_open_dead_with_tstamp_precision()</code></a></li>
  <li><a href="http://www.tcpdump.org/manpages/pcap_open_offline.3pcap.html" rel="nofollow"><code>pcap_open_offline_with_tstamp_precision()</code></a></li>
  <li><a href="http://www.tcpdump.org/manpages/pcap_open_offline.3pcap.html" rel="nofollow"><code>pcap_fopen_offline_with_tstamp_precision()</code></a></li>
  </ul>
  
  <p>Unfortunately, there does not appear to be <code>_with_tstamp_precision</code> variants for <a href="http://www.tcpdump.org/manpages/pcap_open_live.3pcap.html" rel="nofollow"><code>pcap_open_live()</code></a> or <a href="http://www.tcpdump.org/manpages/pcap_create.3pcap.html" rel="nofollow"><code>pcap_create()</code></a>.</p>
  
  <p>I believe that capturing live packets with nanosecond resolution should be possible, because the <a href="http://www.tcpdump.org/libpcap-changes.txt" rel="nofollow">changelog</a> for v1.5.0 says (emphasis mine):</p>
  
  <blockquote>
    <p>Add support for getting nanosecond-resolution time stamps <strong>when capturing</strong> and reading capture files</p>
  </blockquote>
  
  <p>I did see the <a href="http://www.tcpdump.org/manpages/pcap_set_tstamp_type.3pcap.html" rel="nofollow"><code>pcap_set_tstamp_type()</code></a> function and the <a href="http://www.tcpdump.org/manpages/pcap-tstamp.7.html" rel="nofollow"><code>pcap-tstamp</code> man page</a>, which says:</p>
  
  <blockquote>
    <ul>
    <li><code>PCAP_TSTAMP_HOST</code>—<code>host</code>:  Time stamp provided by the host on which the capture is being done.  The precision of this time stamp is unspecified; it might or might not be synchronized with the host operating system's clock.</li>
    <li><code>PCAP_TSTAMP_HOST_LOWPREC</code>—<code>host_lowprec</code>:  Time stamp provided by the host on which the capture is being done.  This is a low-precision time stamp, synchronized with the host operating system's clock.</li>
    <li><code>PCAP_TSTAMP_HOST_HIPREC</code>—<code>host_hiprec</code>:  Time stamp provided by the host on which the capture is being done.  This is a high-precision time stamp; it might or might not be synchronized with the host operating system's clock.  It might be more expensive to fetch than <code>PCAP_TSTAMP_HOST_LOWPREC</code>.</li>
    <li><code>PCAP_TSTAMP_ADAPTER</code>—<code>adapter</code>:  Time stamp provided by the network adapter on which the capture is being done.  This is a high-precision time stamp, synchronized with the host operating system's clock.</li>
    <li><code>PCAP_TSTAMP_ADAPTER_UNSYNCED</code>—<code>adapter_unsynced</code>:  Time stamp provided by the network adapter on which the capture is being done.  This is a high-precision time stamp; it is not synchronized with the host operating system's clock.</li>
    </ul>
  </blockquote>
  
  <p>Does the phrase "high-precision time stamp" here mean that nanosecond values are stored in the header's <code>ts.tv_usec</code> field?  If so, <code>PCAP_TSTAMP_HOST</code> says "unspecified", so how do I determine at runtime whether the <code>ts.tv_usec</code> field holds microseconds or nanoseconds?  And which of these is the default if <code>pcap_set_tstamp_type()</code> is never called?</p>