Time stamp accuracy - WinPCAP Library

[Windows Central Question]

Hi, I am looking for some info re: how to adjust the timestamp accuracy in Windows OS. I remember reading a post a couple of years ago explaining about WinPCAP lib taking time from computer clock and registry values & changing the timestamps mode. I can't find the original post on the net. Any pointers are appreciated.

 

[JasLit]

According to these digital forensic guys the registry key is: HKLM\System\CurrentControlSet\Services\NPF\TimestampMode
Here is the quote:

"The Windows OS offers a range of timestamp modes with varied timestamp accuracy and precision. A user can select the timestamping mode by using the Core Kernel Library Support Routines: KeQueryPerformanceCounter and KeQuerySystemTime or by utilising the RDTSC instructions (on 32-bit systems) instead. "

Hope this answers your question.

 

[Ryujingt3]

Why would you want to do this? Just curious.