Control of system clock
Hi,
Intro: I have a network sniffer connected to a UDP network. I use WinPcap with my data extraction API located on an interface PC. GUI is made in Visual Studio.
I have full control of the time recorded on the sniffer (from extracting time in telegram header) but I run into the following problem: When I try to play back the UDP stream via 100MB onto a server running Win XP, the receiving application receives it's time from the system clock. I am not interested in showing the current time when the playback is not in real time. I am interested in showing the time from the extracted data. When I play back events and alarms all time stamping gets wrong since the UDP playback stream does not contain time stamp in use by my application. I think the best way of dealing with this is to make an offset of the system clock. I can find this offset value, and is able to sync. the HW, but I need to control the system clock on the standalone server for reasons explained above. How can I do this?
A prompt answer is highly appreciated.
Kind regards
Frode Roed
Norway
Thanks for your answer 
We do exactly what you propose, but solution still remains.
The SCADA application that we use on the destination machine receiving the playback packets is using it's internal clock to time stamp alarms etc.
So, when it receives an alarm flag on the playback stream it uses server current time to tag the alarm (the moment of receipt). This is wrong, cause it is the actual time when the alarm occurred we are looking for. It will be difficult to command the Ifix SCADA application to use other means of time stamping than the system clock.
So what remains is to adjust the clock.
Could this be a way to go? http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/setting_the_system_time.asp
I also need to adjust clock down to ms resolution.
frode
Quote:
'Why would the "actual time that the alarm occurred" be different from the time that the system clock gives you? What better source for a timestamp do you have?'
- Because the Playback server is isolated and standalone. It is not the same machine (replica) that originally processed the alarm when it happend.
I wish I could show you the system topology herein, but here is a case:
1) On our network, a NTP server, some PLC's, the sniffer and 'server for Ifix SCADA' is connected
2) On 17:00:00 local time an alarm occurred and this alarm is time stamped on the 'server for Ifix SCADA' (upon arrival) at 17:00:00
3) At 18:00 we extract data from the sniffer for period 16:59:00 to 17:01:00
4) We then start a playback of this 2 min. long stream at 17:59:00 onto an 100% replica machine of the 'server for Ifix SCADA'
5) During playback, the alarm will be triggered and time-stamped by the Ifix SCADA apps. 18:00:00 which is wrong, cause the actual time of the alarm occurred 17:00:00
6) If we turn back clock to 16:59:00 (1 hour) at the moment of starting the playback the alarm will be activated 17:00:00 - now the time is correctly given.
Hope it is somewhat clearer
frode
