The simple concept of attaching an arrival time to a packet causes some of the hardest problems faced by passive measurement systems. As seen so far in this section, the issue of timestamping comes up again and again. The problems discussed so far mainly condenses to two issues, multiple interfaces and delays in the timestamping process.
A delay is introduced whenever a packet is buffered between reception and timestamping. This is most likely to occur in a software based system, but can also occur outside of the monitor in such active devices as switches. It is unlikely that for a given system these delays can be altered, they just have to be known, and accounted for when interpreting results.
The difference in clocks between interfaces is a difficult problem to solve. The ideal solution is to combine the two interfaces to use a single clock. This could occur if the interfaces are combined to a single network card, or the packets get timestamped at the software level, using the system clock. Using a software timestamp can greatly reduce accuracy, and combining interface can often just not be a practical solution. So other systems must be designed. The DAG hardware discussed previously aims to provide methods for a master and slave clocking system. One card provides a clock which the other corrects to. Other advanced clocking methods implemented in DAG hardware are discussed briefly later in this section.
A less accurate, but simple system is for software to reset the clocks on both cards at the same time. Some times one reset could be delayed, causing the cards to start out of synchronisation, but more of an issue in this situation is clock drift.
Clock drift occurs in any simple timing system, where the actual rate of oscillation is slightly different to the stated time. This difference in time will not only be different from actual time, but also different between each card. This causes two effects. First the cards will drift apart from each other over time, loosing synchronisation. This can be corrected by the master-slave system described above. What this will not fix is the relationship between the timestamps recorded and actual time. Over the period of a long trace, the apparent length of the trace recorded will be different to the actual length.
This drift will often be a linear drift, but can also be effected by temperature. The amount of clock drift can be reduced by more accurate timing systems on the card, but will always be present to some degree. An external clock source provides the best method of correcting for this drift. Possible clock sources include the SONET clock present in ATM over optical fiber, cellphone clock systems, and most importantly the Global Positioning System (GPS).
GPS uses an accurate clock system which can be used by the monitor card to synchronise its clock. One other important advantage of the GPS system is it allows monitors in multiple positions around the globe to synchronise all of their clocks. This allows timing to be carried out on packets traveling between these two points, not just a packets round trip time.
The DAG card supports the use of GPS, providing a solution that eliminates, or greatly reduces the problems associated with timestamping.