How to get Timestamp values?

[bharnden]

What conditions would cause Attribute.Timestamp to be filled with a value? Is it based on the queue used or configuration of setting up an nfqueue to listen on?

[florianl]

To have a timestamp in the nf_queue message two conditions [0] are required:

• The hook that generates the nf_queue message has to be NF_INET_PRE_ROUTING, NF_INET_LOCAL_IN or NF_INET_FORWARD
• In the sk_buff the field tstamp needs to be set

[0] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/netfilter/nfnetlink_queue.c#n583

[bharnden]

Thanks for the response, appreciate it.